Security Basics mailing list archives

OS X deleted file time stamp


From: darmour () mcg edu
Date: 14 Sep 2007 01:21:26 -0000

Can anyone recommend a tool to use on a OS X that can attempt to recovery a deleted file and give the date/time that 
the file was deleted?  I've used data rescue II before, but I do not believe it gives me the time.  I am using that 
time to compare who had access to the room (logged card access) where the Mac was located for an investigation.
 
Thank you,
 
-Damon Armour


Current thread: