4cast not updating

If a user copies or moves files from a HFS volume to FAT32 the dates and times are impacted, on the destination, in the following ways: There is more activity than simply updating timestamps for files. If a user copies or moves files from either a Ex FAT or FAT32 volume to HFS the dates and times are impacted, on the destination, in the following ways: Because files stored in HFS volumes typically hold a great deal more metadata than exists in other volumes (extended attributes, etc.), any file being copied from a HFS volume to a Ex FAT or FAT32 volume will also have a matching hidden file created by Mac OS.

If a user copies or moves files from one HFS volume to another the dates and times are impacted, on the destination, in the following ways: All other metadata attributed to the files is stored in the stored in the HFS file system. If a user copies or moves files from a HFS volume to Ex FAT the dates and times are impacted, on the destination, in the following ways: There is more activity than simply updating timestamps for files. Like Ex FAT there’s 3 timestamps, but the Accessed time is only attributable to a day.If a file exists on a HFS volume and it is moved to another folder on that same volume then this metadata value is updated to reflect that move.If you’re using X-Ways Forensic, this value is populated under the “Created²” field.I’ve been doing some testing to attempt to show how file movements on Mac OS systems affect the metadata on the destination. This is a work in progress as there appears to be some inconsistencies that I’ve not yet figured out. These are as follows: Created, modified and accessed are all pretty straight forward.Record change is when the file’s metadata is changed in the catalog (similar to the $MFT in NTFS). This is when a file was copied or moved to its current location.

Leave a Reply