1
Storage Forensics and File System Analysis
medium
A forensic investigator is examining a Mac system with APFS. Which artifact would be most useful for determining the exact time a file was moved to the Trash?
CHFI
Study mode — explanations shown
Storage Forensics and File System Analysis
A forensic investigator is examining a Mac system with APFS. Which artifact would be most useful for determining the exact time a file was moved to the Trash?