We continue to see more and more Apple devices come through our doors here at Digital Discovery.As such I do what I can to increase my knowledge in this area on a regular basis. She truly is a genius, not like the so-called geniuses at the Apple store, a REAL genius. The type of work we tend to investigate the most is intellectual property theft.
By entering and using the Site, you indicate that you accept these Terms and that you agree to be bound by them.
Acceptance of these Terms creates a binding contract between you and 4Cast that you will use the Service only in a manner consistent with these Terms.
Your use of the Service may be for personal purposes only.
You will not (i) reproduce, duplicate, copy, sell, resell or exploit any part of the Service, or (ii) use or access the Service for any commercial purpose.
When a new file is created on a HFS volume the dates and times are as follows: Something to point out here is the “Added Date” value.
If I duplicate a file and then edit the contents of that duplicated file, the “Added Date” field will still show the date and time of the creation of the duplicate.
The information and materials on this website are intended for informational purposes only and are not intended to be treated as financial or tax advice. 4Cast is an independent contractor for all purposes, and is not your agent or trustee. By using this service, you acknowledge and agree that you are an independent contractor and that there is no partnership, joint venture or employment relationship with 4Cast.
Neither the website nor the use of information from the website creates a joint venture, partnership or employment relationship. Neither party will hold itself out as an agent, subsidiary or affiliate of the other party or has any authority to bind the other party to third party obligations.
I’ve been doing some testing to attempt to show how file movements on Mac OS systems affect the metadata on the destination. This is a work in progress as there appears to be some inconsistencies that I’ve not yet figured out. These are as follows: Created, modified and accessed are all pretty straight forward.
Record change is when the file’s metadata is changed in the catalog (similar to the $MFT in NTFS). This is when a file was copied or moved to its current location.
So here you’d have the creation time of the original, the creation time of the duplicate, and the modification time all for the same file.