Copying Files in macOS Can Truncate File Date/Time to One-Second Granularity

2019-09-03 • SEND FEEDBACK |
Related: Apple, Apple Core Rot, Apple macOS

A user of IntegrityChecker reported that verification of backups was resulting in claims of changed file dates. Investigating, I found that copying files from an APFS file system to macOS Extended changes the file dates by truncating the time to the second (truncating, not rounding).

Since macOS Extended supports file times to the millisecond, there is no good explanation for this behavior other than yet one more macOS bug.

It’s a hassle to have files reported with changed dates when verifying data, so I’m making a few changes to IntegrityChecker java version (icj) to handle this situation better, such as not flagging a date change if the new date has a zero millisecond component.

Example of whacked file dates

I used the dgl finfo command to print out this information. It uses 'Carbon' APIs.

This example from one file for brevity; it happens for all files I tested (thousands).

Original on APFS volume

DataFork:         53529, 57344, closed
CreationDate      2019-05-20 22:19:19.80359873 0.3641260759.57184
ContentModDate    2019-05-20 22:19:19.80359877 0.3641260759.57444

Copy on another APFS volume

DataFork:         53529, 57344, closed
CreationDate      2019-05-20 22:19:19.80359873 0.3641260759.57184
ContentModDate    2019-05-20 22:19:19.80359877 0.3641260759.57444

Copy on macOS Extended volume

DataFork:         53529, 57344, closed
CreationDate      2019-05-20 22:19:19.80359000 0.3641260759.0  <== millis truncated
ContentModDate    2019-05-20 22:19:19.80359000 0.3641260759.0

Simon N writes:

Are you sure HFS+ supports milliseconds? As far as I know, the date resolution on HFS+ is 1s, so it seems to be inevitable that the milliseconds from APFS-originating files get cut off. One might argue Apple could have implemented rounding instead of truncating, but the outcome would (essentially) be the same.

MPG: I see that Wikipedia shows "Date resolution" as "1s", so perhaps my assumptions are invalid.

Because macOS Extended (HFS Plus) uses a 48 bit number for date/time (16 bit each for High/Low/Fraction), I had assumed that non-zero values in the fraction part of the number were milliseconds.

Since many files have non-zero values in the fraction part, it only made sense that this represents milliseconds. But if the file system only does time to the second, then these values are essentially garbage, or being used for oddball purposes by Apple.

Still, rumors suggest that macOS S***ForBrains 99.99.99 will fix all bugs forever.