Is there a writeup on the specifics of HFS+ mac times? #dfir
3
Replying to @attrc
@attrc I had one, but forgot where I put it. See the coversion routine I put into log2timeline for my Safari module-- might have noted URL.

Oct 21, 2011 · 8:51 PM UTC