Page 1

SPOTLIGHT & MACOSMETADATA · A GUIDE FOR UK LAWYERS macOS Spotlight and Metadata Deep-Dive The Index That Remembers Files the Mac No Longer Has COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SPOTLIGHT INDEX ANALYSIS FILE-ORIGIN & METADATA DATING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the index outlives the file 03 How Spotlight and macOS metadata work 04 What the metadata reliably shows 05 Index remnants: evidence of files that have gone 06 Interpretation, origin data and honest limits 07 Deployment: origin, use and the file that left 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Spotlight indexes the files on a Mac with rich metadata, dates, origins and attributes, that index entry may evidence that a deleted or removed file once existed, and where it came from.

§ 02 · FIRST PRINCIPLES The problem in plain English: the index outlives the file

§ 03 · HOW IT WORK S How Spotlight and macOS metadata work FILES INDEX METADATA OR IG IN / DATES REMNANTS