Monthly Archives: October 2016

  • MacOS Timestamps from Extended Attributes and Spotlight

    Posted on October 18, 2016 by Lee Whitfield in Technical Articles.

    I started this whole thing just with a general idea that I want to track times across USB devices on MacOS. As I went further down the rabbit-hole, however, I seem to have gotten lost and can’t seem to find my way back without finding more unexplored tunnels. It seems as if there are more […]

    No Comments.
    Continue Reading...
  • More MacOS File Movements

    Posted on October 17, 2016 by Lee Whitfield in Technical Articles.

    No sooner had I posted the last article than I started getting questions, all along the same theme. “What about NTFS?” They shout. “I’m working on it,” I replied. And so I was. To review, HFS+ has five timestamps: Created Modified (last written) Accessed Record Change Added Date NTFS, on the other hand, has eight: […]

    No Comments.
    Continue Reading...
  • MacOS File Movements

    Posted on October 13, 2016 by Lee Whitfield in Technical Articles.

    We continue to see more and more Apple devices come through our doors here at Digital Discovery. As such I do what I can to increase my knowledge in this area on a regular basis. I often rely on Sarah Edwards for assistance. She truly is a genius, not like the so-called geniuses at the […]

    2 Comments.
    Continue Reading...