Can you recover deleted but running exes on live OS X? Linux example of it: pastebin.com/LC3dj152 CC: @iamevltwin @osxreverser #DFIR
1
8
23
@attrc @osxreverser Can't say I've ever tried. :\
1
@iamevltwin @attrc @osxreverser "lsof +L1" to show unlinked open file CNID, then icat to recover?
1
@hal_pomeranz I will try that if I can figure out why TSK won’t compile. That didn’t work on Linux though
1
@attrc Just tested it on my Yosemite box and it worked fine. I've done it on Linux too-- though there you can just use /proc/<pid>/exe
2
2
@attrc Hadn't looked at the pastebin-- but, yes, I just tested recovering deleted binary from a deleted directory with lsof/icat/Yosemite

Feb 8, 2015 · 6:30 PM UTC

1
Replying to @hal_pomeranz
@hal_pomeranz ah nice. Can you pastebin istat on the file and it's directory ?
1
@attrc pastebin.com/HGW8Wk3K
1
more replies