HFS+ Private Direct...
 
Notifications
Clear all

HFS+ Private Directory Data file question

1 Posts
1 Users
0 Reactions
1,350 Views
(@scales561)
Posts: 2
New Member
Topic starter
 

Hi there,

I have a Lacie external drive with a Time Machine backup. I see inside the .HFS+ Private Directory Data folder directory sub-folders actual file names showing deleted. For example, LaCieExtHDD.001 - Entire Disk (Apple HFS+, 1.82 TB) Backup\.HFS+ Private Directory Data\dir_17880739\2019-03-14\Employment Contract (deleted fe1154d44f95032fddbc32106780be7f).docx

Have you seen this before and if so, does this indicate this file was deleted on the Date Accessed? My main objective is to determine if the backup drive was accessed within a specific time frame as the custodian has stated it was put into storage and not touched until it was provided to us. Date range is 3/21/2019 - 9/7/2020. 

File System Last Modified Date/Time: 10/20/2017 2:46:45 PM

File System Last Accessed Date/Time: 8/31/2020 10:58:05 AM

File System Created Date/Time: 1/3/2019 3:15:26 PM

Does the last access date and the file name indicated (deleted) mean the file was deleted on the Last Access Date/Time?

Thanks 😀 

 

 
Posted : 15/01/2021 4:18 pm
Share: