Greetings Everyone!
While I'm waiting to be "verified" by the only macintosh forensic newgroup I could find in a span of 3 hours, I thought I would turn to the trusty, brawny forensic focus board to assist me in a problem I have come across.
A theory of mine is that a OSX machine will delete the trash folder when you "empty" it and create a new one. Let's say the machine was bought about a year ago, been used for a year but the users trash folder is about a week old and the deleted content inside the trash folder is a few days old. I know that on every mounted volume, there is a hidden trash folder that hides the hidden user trash folders as well, but I would really appreciate it if someone may tell me how I can tell when a user last emptied their trash folder?
Thank you and have an awesome, safe Halloween.
I see you have no responses. I am not a Macintosh expert but found this to be of interest. Maybe post there to get your answer.
http//
thank you for the response! That's the Yahoo! Group that is still pending my approval. The only person I know of that has a mac is in Boston on assignment and I need to know this info asap. Thank you again though!