±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35140
New Yesterday: 1 Visitors: 119

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Macintosh deleted files - are there any logs?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Macintosh deleted files - are there any logs?

Post Posted: Mon Jul 15, 2013 4:06 pm

I am trying to determine if files have been deleted on a MacBook Air.

I am very familiar with HFS+ and know that files are removed from the directory, rather than tagged as deleted, as on the PC (and some others).

Does the Mac have any useful files like Windows event logs, or UserJournal, that logs deletions?

All logs I have looked at /var/log/... do not seem to have any such information
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 

mscotgrove
Senior Member
 
 
  

Re: Macintosh deleted files - are there any logs?

Post Posted: Mon Jul 15, 2013 5:07 pm

NOT an answer to your question, and cannot say if useful in your case, but the Author of Plop has made available recently a nice little "rescue" tool for HFS+:
www.plop.at/en/hfsprescue.html

And Photorec is another "quick" option:
www.cgsecurity.org/wiki/PhotoRec

Maybe it can be useful to see which deleted files they can find.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Macintosh deleted files - are there any logs?

Post Posted: Tue Jul 23, 2013 6:51 pm

There are a large amount of .Plist files dotted around the Mac OS X that could be of help but it really determines exactly what kind of files you are looking for.  

zekituredi
Member
 
 
  

Re: Macintosh deleted files - are there any logs?

Post Posted: Wed Jul 24, 2013 7:18 am

Deleted Word documents are of most interest.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 

mscotgrove
Senior Member
 
 
  

Re: Macintosh deleted files - are there any logs?

Post Posted: Mon Sep 16, 2013 5:03 am

i havent got an answer but i do have a similar problem (bumping this up in case someone else has found a solution)

trying to find out when a specific file was deleted
the only thing I can think of is to determine if the file was accessed so as to narrow down the last time the file was viewed

can anyone think of anything else?
thanks!  

randomaccess
Senior Member
 
 

Page 1 of 1