OS X: Signs of Wiping

Discussion in 'privacy technology' started by rafael_lefort, Jun 8, 2012.

Thread Status:
Not open for further replies.
  1. rafael_lefort

    rafael_lefort Registered Member

    Jun 8, 2012
    I'm trying to cover all the possible ways that one could tell if a person did any kind of data wiping on a company computer (a Mac). For various reasons, I'm sure no outside data wiping software was installed, so I think I'm asking for signs that a person i) used secure erase from the disk utility, 2) used 'srm' from the command line, or 3) did a secure empty trash.

    I've covered bash history, and I've grep'd all the logs in /var/log for "preparing to" to find evidence that the disk utility was run.

    Anything I'm missing?

Thread Status:
Not open for further replies.