Can you recover deleted but running exes on live OS X? Linux example of it: pastebin.com/LC3dj152 CC: @iamevltwin @osxreverser #DFIR
1
8
23
@attrc @osxreverser Can't say I've ever tried. :\
1
@iamevltwin @attrc @osxreverser "lsof +L1" to show unlinked open file CNID, then icat to recover?
1
@hal_pomeranz I will try that if I can figure out why TSK won’t compile. That didn’t work on Linux though
1
@attrc Just tested it on my Yosemite box and it worked fine. I've done it on Linux too-- though there you can just use /proc/<pid>/exe
2
2
@attrc Hadn't looked at the pastebin-- but, yes, I just tested recovering deleted binary from a deleted directory with lsof/icat/Yosemite
1
@hal_pomeranz ah nice. Can you pastebin istat on the file and it's directory ?
1
@attrc pastebin.com/HGW8Wk3K
1
@hal_pomeranz ok, can you also istat /dev/rdisk1 6581178 ? Curious if Mac is keeping the file allocated or not
1
Replying to @attrc
@attrc Whoops! Here's a more complete paste with istat output - pastebin.com/zPb6Wjjr - istill allocated as long as the process is running

Feb 8, 2015 · 6:59 PM UTC

1
1
2
Replying to @hal_pomeranz
@hal_pomeranz thanks, weird that it differs from Linux, but good since no /proc equivalent that I know of
2
@attrc Interesting. EXT4 shows the inode as allocated but the size and extents are zeroed when the file is unlinked. This could be a bug.
1
more replies