One of my students from a #FOR508 class I taught took some of my initial research on #macOS #timestamps and extended it further to find macOS updates timestamps differently for different file types as well 🤯

Here’s there research that Crystal Tan recently did. If you do macOS #DFIR work, this is definitely worth a read.

🔗 https://forensicatorjourney.gitbook.io/d.forensicatorjourney/research/2023-12-05-file-timestamps-on-macos

#digitalforensics