Author: darmour, Posted: Fri Sep 14, 2007 4:20 am Post subject: OS X Delete Time stamp ---- Can anyone recommend a tool to use on a OS X that can attempt to recovery a deleted file and give the date/time that the file was deleted? I've used data rescue II before, but I do not believe it gives me the time. I am using that time to compare who had access to the room (logged card access) where the Mac was located for an investigation.
Thank you,
-Damon Armour
Author: Sherman Homan, Location: Norwell, MAPosted: Tue Sep 18, 2007 1:30 am Post subject: ---- OS X does not keep a log of deleted files that I know of. Does Data Rescue give you the modified date of the recovered file? I don't know if this will work, but deleting the file probably changes the date modified stamp. Of course the act of recovering the file might change it again...
Author: darmour, Posted: Tue Sep 18, 2007 2:31 am Post subject: ---- Yea I ran Data Rescue and it set the modification time stamp to the time it was recovered. Thanks for the reply. I even contacted a representative from Encase and they stated that they knew of no way to find the time stamp.
Does OS X keep a time stamp on when the trash was emptied?