Join Us!

Macintosh Forensics...
Clear all

Macintosh Forensics ... DUN Dun dunnnnn  

New Member

Greetings Everyone!

While I'm waiting to be "verified" by the only macintosh forensic newgroup I could find in a span of 3 hours, I thought I would turn to the trusty, brawny forensic focus board to assist me in a problem I have come across.

A theory of mine is that a OSX machine will delete the trash folder when you "empty" it and create a new one. Let's say the machine was bought about a year ago, been used for a year but the users trash folder is about a week old and the deleted content inside the trash folder is a few days old. I know that on every mounted volume, there is a hidden trash folder that hides the hidden user trash folders as well, but I would really appreciate it if someone may tell me how I can tell when a user last emptied their trash folder?

Thank you and have an awesome, safe Halloween.

Posted : 01/11/2005 2:04 am
Active Member

I see you have no responses. I am not a Macintosh expert but found this to be of interest. Maybe post there to get your answer.


Posted : 02/11/2005 1:53 am
New Member

thank you for the response! That's the Yahoo! Group that is still pending my approval. The only person I know of that has a mac is in Boston on assignment and I need to know this info asap. Thank you again though!

Posted : 02/11/2005 2:28 am