• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

OS X Delete Time stamp

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Macintosh

View previous topic :: View next topic  
Author Message
darmour
Just Arrived
Just Arrived


Joined: 14 Sep 2007
Posts: 0


Offline

PostPosted: Fri Sep 14, 2007 4:20 am    Post subject: OS X Delete Time stamp Reply with quote

Can anyone recommend a tool to use on a OS X that can attempt to recovery a deleted file and give the date/time that the file was deleted? I've used data rescue II before, but I do not believe it gives me the time. I am using that time to compare who had access to the room (logged card access) where the Mac was located for an investigation.

Thank you,

-Damon Armour
Back to top
View user's profile Send private message
Sherman Homan
Just Arrived
Just Arrived


Joined: 26 Sep 2006
Posts: 0
Location: Norwell, MA

Offline

PostPosted: Tue Sep 18, 2007 1:30 am    Post subject: Reply with quote

OS X does not keep a log of deleted files that I know of. Does Data Rescue give you the modified date of the recovered file? I don't know if this will work, but deleting the file probably changes the date modified stamp. Of course the act of recovering the file might change it again...
Back to top
View user's profile Send private message Send e-mail Visit poster's website
darmour
Just Arrived
Just Arrived


Joined: 14 Sep 2007
Posts: 0


Offline

PostPosted: Tue Sep 18, 2007 2:31 am    Post subject: Reply with quote

Yea I ran Data Rescue and it set the modification time stamp to the time it was recovered. Thanks for the reply. I even contacted a representative from Encase and they stated that they knew of no way to find the time stamp.

Does OS X keep a time stamp on when the trash was emptied?
Back to top
View user's profile Send private message
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Macintosh All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register