When you copy files on Windows the metadata is changed, and if you want to preserve created and modification timestamps you have to use something like RichCopy.
However in Mac are my results correct that all the metadata timestamps are preserved when copying files between devices?
If you copy a file in windows, the Modify date is not changed.
If you copy a file in windows to a new physical drive, the Create date is changed.
If you move a file in Windows to the same drive, dates are not changed.
If you copy a file in windows, the Modify date is not changed.
If you copy a file in windows to a new physical drive, the Create date is changed.
If you move a file in Windows to the same drive, dates are not changed.
Correct. Now what I am trying to confirm is when you copy from Mac to an external drive the create date remains unchanged - is this correct? And does it only apply to files not folders?
https://
https://
forensic4cast.com/2016/10/macos-file-movements/
This was brilliant! Any equivalent for NTFS format?
Look at the top right chart first page of the forensic analysis poster
https://