Hello Reader,
It's that time again, Sunday Funday time! For those not familiar every Sunday I throw down the forensic gauntlet by asking a tough question. To the winner go the accolades of their peers and prizes hopefully worth the time they put into their answer.
The Prize:
The Challenge:
Your suspect is running OSX 10.8 Mountain Lion, he has wiped a document from his system that you know was downloaded from his google drive that by his internet history name appears to be related to a business plan and ends with a iWork extension. Based on the recent items plists it would appear as though this document was edited on this system but there is no time machine backups.
What can you do recover any of the contents of this wiped document?
It's that time again, Sunday Funday time! For those not familiar every Sunday I throw down the forensic gauntlet by asking a tough question. To the winner go the accolades of their peers and prizes hopefully worth the time they put into their answer.
The Prize:
The Rules:
- You must post your answer before Monday 9/23/13 1PM CST (GMT -5)
- The most complete answer wins
- You are allowed to edit your answer after posting
- If two answers are too similar for one to win, the one with the earlier posting time wins
- Be specific and be thoughtful
- Anonymous entries are allowed, please email them to dcowen@g-cpartners.com
- In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post
The Challenge:
Your suspect is running OSX 10.8 Mountain Lion, he has wiped a document from his system that you know was downloaded from his google drive that by his internet history name appears to be related to a business plan and ends with a iWork extension. Based on the recent items plists it would appear as though this document was edited on this system but there is no time machine backups.
What can you do recover any of the contents of this wiped document?
