Macintosh Forensics ... DUN Dun dunnnnn
While I'm waiting to be "verified" by the only macintosh forensic newgroup I could find in a span of 3 hours, I thought I would turn to the trusty, brawny forensic focus board to assist me in a problem I have come across.
A theory of mine is that a OSX machine will delete the trash folder when you "empty" it and create a new one. Let's say the machine was bought about a year ago, been used for a year but the users trash folder is about a week old and the deleted content inside the trash folder is a few days old. I know that on every mounted volume, there is a hidden trash folder that hides the hidden user trash folders as well, but I would really appreciate it if someone may tell me how I can tell when a user last emptied their trash folder?
Thank you and have an awesome, safe Halloween.
thank you for the response! That's the Yahoo! Group that is still pending my approval. The only person I know of that has a mac is in Boston on assignment and I need to know this info asap. Thank you again though!