Abstract
Spoliation of evidence is a critical concern in various crimes such as information leakage, digital sexual crimes, accounting fraud, and copyright infringement. Several traditional digital forensic investigation methods such as recovery, carving, and anti-forensic behavior tracking are used to investigate these crimes. However, as technology has advanced, recovery and carving have become increasingly challenging. Shortly, data recovery will reach its technological limit, and it will be essential to obtain as much circumstantial evidence as possible based on traces of data left in suspect systems. However, no existing method can systematically track the spoliation of evidence; contemporary investigations typically depend solely on investigators’ skills and knowledge. This paper proposes a method to track deleted files by identifying and analyzing various sources that manage file-related metadata in macOS systems.
Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: Forensic Science International: Digital Investigation
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
