Skip to main content
added 592 characters in body
Source Link
gollum
  • 456
  • 4
  • 16

Update 2:

I've come across a blog post by Adam Harrison (a digital forensics investigator from UK): exFAT Timestamp Behavior Associated with Different Operating Systems

Quoting:

Ubuntu 16.04 and Ubuntu 18.04
All timezones are recorded in UTC. The Timezone fields are consistently set to 00, indicating that they are not in use.

OSX 10.13.3
Timezone Fields – Consistently set to “FC” which is UTC-1 and I have no idea why...

So this seems to match my findings.

Update 2:

I've come across a blog post by Adam Harrison (a digital forensics investigator from UK): exFAT Timestamp Behavior Associated with Different Operating Systems

Quoting:

Ubuntu 16.04 and Ubuntu 18.04
All timezones are recorded in UTC. The Timezone fields are consistently set to 00, indicating that they are not in use.

OSX 10.13.3
Timezone Fields – Consistently set to “FC” which is UTC-1 and I have no idea why...

So this seems to match my findings.

added 1 character in body
Source Link
gollum
  • 456
  • 4
  • 16
# create a 10Mb exFAT disk image:
hdiutil create -size 10m -fs ExFAT -volname EXFATTEST exfattest.dmg

# attach the diskimage
hdiutil attach exfattest.dmg

# create a test file with a creation time of Jan 1, 1980 00:00:00
touch -t "198001010000.00" /Volumes/EXFATTEST/testtest1.txt
ls -lT /Volumes/EXFATTEST/test1.txt 
-rwxrwxrwx  1 user  staff  0 Jan  1 02:00:00 1980 /Volumes/EXFATTEST/test1.txt
#                                   ^^ off by two hours

# try a file with 3am
touch -t "198001010300.00" /Volumes/EXFATTEST/test2.txt
ls -lT /Volumes/EXFATTEST/test2.txt
-rwxrwxrwx  1 user  staff  0 Jan  1 03:00:00 1980 /Volumes/EXFATTEST/test2.txt
#                                   ^^ works as expected


# unmount the disk image
hdiutil detach /Volumes/EXFATTEST/
# create a 10Mb exFAT disk image:
hdiutil create -size 10m -fs ExFAT -volname EXFATTEST exfattest.dmg

# attach the diskimage
hdiutil attach exfattest.dmg

# create a test file with a creation time of Jan 1, 1980 00:00:00
touch -t "198001010000.00" /Volumes/EXFATTEST/test.txt
ls -lT /Volumes/EXFATTEST/test1.txt 
-rwxrwxrwx  1 user  staff  0 Jan  1 02:00:00 1980 /Volumes/EXFATTEST/test1.txt
#                                   ^^ off by two hours

# try a file with 3am
touch -t "198001010300.00" /Volumes/EXFATTEST/test2.txt
ls -lT /Volumes/EXFATTEST/test2.txt
-rwxrwxrwx  1 user  staff  0 Jan  1 03:00:00 1980 /Volumes/EXFATTEST/test2.txt
#                                   ^^ works as expected


# unmount the disk image
hdiutil detach /Volumes/EXFATTEST/
# create a 10Mb exFAT disk image:
hdiutil create -size 10m -fs ExFAT -volname EXFATTEST exfattest.dmg

# attach the diskimage
hdiutil attach exfattest.dmg

# create a test file with a creation time of Jan 1, 1980 00:00:00
touch -t "198001010000.00" /Volumes/EXFATTEST/test1.txt
ls -lT /Volumes/EXFATTEST/test1.txt 
-rwxrwxrwx  1 user  staff  0 Jan  1 02:00:00 1980 /Volumes/EXFATTEST/test1.txt
#                                   ^^ off by two hours

# try a file with 3am
touch -t "198001010300.00" /Volumes/EXFATTEST/test2.txt
ls -lT /Volumes/EXFATTEST/test2.txt
-rwxrwxrwx  1 user  staff  0 Jan  1 03:00:00 1980 /Volumes/EXFATTEST/test2.txt
#                                   ^^ works as expected


# unmount the disk image
hdiutil detach /Volumes/EXFATTEST/
edited title
Link
gollum
  • 456
  • 4
  • 16

Mac OS X - exFAT file modification time issue

added 919 characters in body
Source Link
gollum
  • 456
  • 4
  • 16
Loading
added 2460 characters in body
Source Link
gollum
  • 456
  • 4
  • 16
Loading
Source Link
gollum
  • 456
  • 4
  • 16
Loading