OS X: Signs of Wiping

Discussion in 'privacy technology' started by rafael_lefort, Jun 8, 2012.

Thread Status:
Not open for further replies.
  1. rafael_lefort

    rafael_lefort Registered Member

    Joined:
    Jun 8, 2012
    Posts:
    1
    Location:
    US
    I'm trying to cover all the possible ways that one could tell if a person did any kind of data wiping on a company computer (a Mac). For various reasons, I'm sure no outside data wiping software was installed, so I think I'm asking for signs that a person i) used secure erase from the disk utility, 2) used 'srm' from the command line, or 3) did a secure empty trash.

    I've covered bash history, and I've grep'd all the logs in /var/log for "preparing to" to find evidence that the disk utility was run.

    Anything I'm missing?

    Thanks
     
Loading...
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.