I've been researching a new strain of MacOS malware for about a year and am trying to zero in on changes that are made to the OS as well as capturing files that the malware is self-deleting. I was wondering if there is a way to modify GC behaviors and: a. Modify/prevent cache deletion b. Modifying the Recycle Bin/GC to save a copy of every file marked for deletion to a separate folder c. Hiding the real Recycle Bin similar to the method of creating a chroot jail?
I understand that modifying these behaviors can have negative affects on the overall performance but I will only need to use the mentioned adjustments for a limited period of time that will probably not exceed 24 hours. Curious if even that short of a time span would cause unintended consequences or if there are any other methods for accomplishing the aforementioned tactics.