OS X Delete Time stamp

Networking/Security Forums -> Macintosh

Author: darmour PostPosted: Fri Sep 14, 2007 4:20 am    Post subject: OS X Delete Time stamp
    ----
Can anyone recommend a tool to use on a OS X that can attempt to recovery a deleted file and give the date/time that the file was deleted? I've used data rescue II before, but I do not believe it gives me the time. I am using that time to compare who had access to the room (logged card access) where the Mac was located for an investigation.

Thank you,

-Damon Armour

Author: Sherman HomanLocation: Norwell, MA PostPosted: Tue Sep 18, 2007 1:30 am    Post subject:
    ----
OS X does not keep a log of deleted files that I know of. Does Data Rescue give you the modified date of the recovered file? I don't know if this will work, but deleting the file probably changes the date modified stamp. Of course the act of recovering the file might change it again...

Author: darmour PostPosted: Tue Sep 18, 2007 2:31 am    Post subject:
    ----
Yea I ran Data Rescue and it set the modification time stamp to the time it was recovered. Thanks for the reply. I even contacted a representative from Encase and they stated that they knew of no way to find the time stamp.

Does OS X keep a time stamp on when the trash was emptied?



Networking/Security Forums -> Macintosh


output generated using printer-friendly topic mod, All times are GMT + 2 Hours

Page 1 of 1

Powered by phpBB 2.0.x © 2001 phpBB Group