MAC Times for Mac

I'm sure I saw something in the apple technical note about this. Not sure where abouts it is, and its a long document, but im pritty sure it will be in here.

http//developer.apple.com/technotes/tn/tn1150.html#MetadataZone

I would suggest taking a look at Brian Carrier's File System Forensic Analysis. If I got it right, MAC OS is supposed to use UFS as File System, and there are two chapters enterly devoted to this File System (one for concepts and the other one for data structures).

Hope it helps.

Mac OS X actually uses predominantly HFS+. (UFS has been supported to varying degrees, but is not the default file system format.)

The Apple document you probably want is Tech Note 1150, which describes the HFS+ file system. There is also Amit Singh's Mac OS X book and Ryan Kubasiak's OS X forensics book.

Thx all for the replies. However, I'm loking more to see if anyone has done or come across research on the behavioural aspects of Mac times on HFS. Something like this paper would be helpful.

Thx

Paul