Spoliation of evidence is a critical concern in various crimes such as information leakage, digital sexual crimes, accounting fraud, and copyright infringement. Several traditional digital forensic investigation methods such as recovery, carving, and anti-forensic behavior tracking are used to investigate these crimes. However, as technology has advanced, recovery and carving have become increasingly challenging. Shortly, data recovery will reach its technological limit, and it will be essential to obtain as much circumstantial evidence as possible based on traces of data left in suspect systems. However, no existing method can systematically track the spoliation of evidence; contemporary investigations typically depend solely on investigators’ skills and knowledge. This paper proposes a method to track deleted files by identifying and analyzing various sources that manage file-related metadata in macOS systems.
