Macintosh deleted f...
 
Notifications
Clear all

Macintosh deleted files - are there any logs?

5 Posts
4 Users
0 Likes
1,359 Views
(@mscotgrove)
Posts: 938
Prominent Member
Topic starter
 

I am trying to determine if files have been deleted on a MacBook Air.

I am very familiar with HFS+ and know that files are removed from the directory, rather than tagged as deleted, as on the PC (and some others).

Does the Mac have any useful files like Windows event logs, or UserJournal, that logs deletions?

All logs I have looked at /var/log/… do not seem to have any such information

 
Posted : 15/07/2013 10:06 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

NOT an answer to your question, and cannot say if useful in your case, but the Author of Plop has made available recently a nice little "rescue" tool for HFS+
http//www.plop.at/en/hfsprescue.html

And Photorec is another "quick" option
http//www.cgsecurity.org/wiki/PhotoRec

Maybe it can be useful to see which deleted files they can find.

jaclaz

 
Posted : 15/07/2013 11:07 pm
(@zekituredi)
Posts: 16
Active Member
 

There are a large amount of .Plist files dotted around the Mac OS X that could be of help but it really determines exactly what kind of files you are looking for.

 
Posted : 24/07/2013 12:51 am
(@mscotgrove)
Posts: 938
Prominent Member
Topic starter
 

Deleted Word documents are of most interest.

 
Posted : 24/07/2013 1:18 pm
(@randomaccess)
Posts: 385
Reputable Member
 

i havent got an answer but i do have a similar problem (bumping this up in case someone else has found a solution)

trying to find out when a specific file was deleted
the only thing I can think of is to determine if the file was accessed so as to narrow down the last time the file was viewed

can anyone think of anything else?
thanks!

 
Posted : 16/09/2013 11:03 am
Share: