Copying v Dragging a file to an OS X Disk Image [source: ThinkDFIR]
by CIRT Team
Had a need to do some quick testing on different operations on OS X 10.10.5 (Yosemite) and thought I’d share.
Created a new disk image, and then copied an existing file into it. Then created a new file, and dragged that into the disk image. Here is what we may found!
Action Plan
- Copy Existing File
I had a file which had some text in it, it was called “hello.txt”. I hadn’t changed it in a few days, but I did open it just before I ran the “stat” command to see what was inside. This is reflected in the “Access” timestamp.
- Drag Existing File
Next I created a new file, world.txt, and here’s the metadata for that one. (Opened Textedit, mashed some text and save).
Addendum
Funny thing happened, I copied the image to another Mac (running 10.13.6). The ‘Date Added’ is present for all three items, which is not the same behaviour that was seen on the previous OS; at least from a presentation standpoint. This does mean that my theory that the two operations were treated differently may be false, but at the very least I can show that the ‘Date Added’ shows when the file appeared on the volume.
For more, click here.
Recommended Posts

WhatsApp down for millions of users globally: App not working for group and individual chats; Twitter gets flooded with memes
25 Oct 2022 - News, News Clipping
সাইবার-নিরাপত্তা-সূচকে-এগিয়েছে-বাংলাদেশ
30 Jun 2021 - CIRT In Media, News Clipping