Is either software able to recover deleted files from Mac OS X or any other HFS+ formatted drive? I tried data carving unallocated space in Mac OS X in FTK but was unable to recover anything.
Both software tools recognize the HFS+ file system, but perhaps the owner was using a secure erase function. Does it look like there is any significant or recognizable data in unallocated clusters?
Mac OS can have a default secure erase of the trash. My systems are set this way. I suspect this is what you have encountered.
Is either software able to recover deleted files from Mac OS X or any other HFS+ formatted drive? I tried data carving unallocated space in Mac OS X in FTK but was unable to recover anything.
try looking more in the Unallocated space, as the default setting in newer versions have Secure deletion, so initially you might find full zeroed out disk area under unallocated, just to double check try scrolling down or do a manual carve with strings..
just my 2 cents.
Have you looked at Ryan Kubasiak's Apple Examiner blog? It's a great resource for Mac tools other than the usual FTK Encase etc http//
I must confess that my experience of Macs is that recovering deleted data has generally been an issue