Essentially, when you copy files from the computer to an external drive -
On Mac - the metadata is preserved
On Windows - the metadata is not preserved
Is this correct?
No, it isn't correct. It is more complex.
It depends on the file systems in use on each drive. e.g. NTFS to FAT32 or HFS+ to FAT32, or FAT32 to FAT32.
It also depends on the tool used to copy the file. e.g. drag and drop in Windows explorer, xcopy, or some specialised forensic's tool.
Also depends on what you define as metadata. e.g. dates, times, streams, file ownership, encryption, hard links, junctions, fragmentation, slack space, alternative 8.3 names, compression, attributes, etc…..
What Passmark said. Typically copying files onto an external drive from a Windows machine will mean brand new created dates and times for the files copied whereas Macs tend to keep the original created dates and times when files are copied. But as always there are lots of ifs and buts, if you want to rely upon whatever you are trying to prove, you'll need to test it.
I think I've read a thread about this before, but I can't find it now. The informations from this link help a lot to know the reality regarding file times in Windows 10
http//
Thanks to Oleg Skulkin and Igor Mikhaylov for their tests and conclusions!
If somebody got anything similar for Macs, feel free to post it, that would also be very useful.
