Copying file on Win...
 
Notifications
Clear all

Copying file on Windows Vs Mac

6 Posts
3 Users
0 Likes
558 Views
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

When you copy files on Windows the metadata is changed, and if you want to preserve created and modification timestamps you have to use something like RichCopy.

However in Mac are my results correct that all the metadata timestamps are preserved when copying files between devices?

 
Posted : 13/08/2017 8:25 am
(@mscotgrove)
Posts: 938
Prominent Member
 

If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.

 
Posted : 13/08/2017 4:14 pm
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

If you copy a file in windows, the Modify date is not changed.

If you copy a file in windows to a new physical drive, the Create date is changed.

If you move a file in Windows to the same drive, dates are not changed.

Correct. Now what I am trying to confirm is when you copy from Mac to an external drive the create date remains unchanged - is this correct? And does it only apply to files not folders?

 
Posted : 13/08/2017 9:49 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

https://forensic4cast.com/2016/10/macos-file-movements/

 
Posted : 14/08/2017 7:12 pm
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

https://forensic4cast.com/2016/10/macos-file-movements/

This was brilliant! Any equivalent for NTFS format?

 
Posted : 17/08/2017 12:40 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

Look at the top right chart first page of the forensic analysis poster

https://www.sans.org/security-resources/posters/

 
Posted : 17/08/2017 2:21 pm
Share: