In digital forensics, analyzing timestamps can provide valuable insights into the timeline of events and help reconstruct a digital crime scene. This article focuses on macOS forensics and delves into the analysis of timestamps using a real-world example.
By examining the metadata of a file, specifically the “icon.png.webp” file, we will explore various timestamps and their significance in forensic investigations.
Example
Let’s start by analyzing the metadata of the “icon.png.webp” file using the “mdls
” command in macOS, generally located in /usr/bin/mdls
.