Can you recover deleted but running exes on live OS X? Linux example of it: pastebin.com/LC3dj152 CC: @iamevltwin @osxreverser #DFIR
1
8
23
Feb 8, 2015 · 5:46 PM UTC
1
@hal_pomeranz I will try that if I can figure out why TSK won’t compile. That didn’t work on Linux though
1
@attrc Just tested it on my Yosemite box and it worked fine. I've done it on Linux too-- though there you can just use /proc/<pid>/exe
2
2