MacOS File Movements

We continue to see more and more Apple devices come through our doors here at Digital Discovery. As such I do what I can to increase my knowledge in this area on a regular basis. I often rely on Sarah Edwards for assistance. She truly is a genius, not like the so-called geniuses at the Apple store, a REAL genius. Anyways…

The type of work we tend to investigate the most is intellectual property theft. More often than not, these cases center on a former employee’s use of external USB devices to transfer data from their work computer. Whether the data belongs to the company or an individual is up to the court to decide, my focus is on what the data says.

I’ve been doing some testing to attempt to show how file movements on MacOS systems affect the metadata on the destination. I thought I’d share my findings. This is a work in progress as there appears to be some inconsistencies that I’ve not yet figured out.
HFS+ has five distinct date and time stamps. These are as follows:

• Created
• Modified (last written)
• Accessed
• Record Change
• Added Date

Created, modified and accessed are all pretty straight forward. Record change is when the file’s metadata is changed in the catalog (similar to the $MFT in NTFS).

“Added Date” is a relatively new discovery. This is when a file was copied or moved to its current location. If a file exists on a HFS+ volume and it is moved to another folder on that same volume then this metadata value is updated to reflect that move. If you’re using X-Ways Forensic, this value is populated under the “Created²” field.

File Creation on HFS+

When a new file is created on a HFS+ volume the dates and times are as follows:

• Created - Time of creation
• Modified - Time of creation
• Accessed - Time of creation
• Record Changed – Time of creation
• Added Date – Not populated

Duplication of files on HFS+

When a file is duplicated (right click on a file and select “Duplicate” from the context menu) on a HFS+ volume the dates and times are impacted in the following way:

• Created - Inherited from the original
• Modified - Inherited from the original
• Accessed - Time of duplication
• Record Changed - Time of duplication
• Added Date - Time of duplication

Modifying of files on HFS+

When a file is modified (edited) on a HFS+ volume the dates and times are impacted in the following way:

• Created - Unchanged
• Modified - Time of modification
• Accessed - Time of modification
• Record Changed - Time of modification
• Added Date - No change

Something to point out here is the “Added Date” value. If I duplicate a file and then edit the contents of that duplicated file, the “Added Date” field will still show the date and time of the creation of the duplicate. So here you’d have the creation time of the original, the creation time of the duplicate, and the modification time all for the same file.

HFS+ to HFS+

If a user copies or moves files from one HFS+ volume to another the dates and times are impacted, on the destination, in the following ways:

• Created – Inherited from the original
• Modified – Inherited from the original
• Accessed – Updated to time of copy
• Record Changed – Updated to time of copy
• Added Date – Updated to time of copy

All other metadata attributed to the files is stored in the stored in the HFS+ file system.

HFS+ to ExFAT

ExFAT only has 3 timestamps. If a user copies or moves files from a HFS+ volume to ExFAT the dates and times are impacted, on the destination, in the following ways:

• Created – Inherited from the original
• Modified – Inherited from the original
• Accessed - Updated to time of copy