Mac OSX Forensic (Mini-Series 4) – 10.8 User Folder

User folder in OS X 10.8 (Mountain Lion) is the same like other version of OS X 10. This folder contain most of the login user’s activities on a Mac system. Among the wealth of information in this folder are the user’s preferences. In a default user folder, you are likely to find the following folders/files:

  • Desktop
  • Documents
  • Downloads
  • Library: hidden folder containing preferences
  • Movies
  • Music
  • Pictures
  • Public
  • Trash: User trash folder before they are remove from the system
  • .bash_history: Terminal command history

Some of important files include:

  • General preferences for user: ~/Library/Preferences/.GlobalPreferences.plist
  • AddressBook preferences: ~/Library/Preferences/
  • Desktop Service: ~/Library/Preferences/
  • Dock – Apps keep in Docks (presistent-apps): ~/Library/Preferences/
  • Finder preferences: ~/Library/Preferences/
  • Finder – Recent folders: ~/Library/Preferences/
  • iCal preferences: ~/Library/Preferences/
  • Facetime – Account: ~/Library/Preferences/
  • iMessage – Account: ~/Library/Preferences/
  • iPhoto preferences: ~/Library/Preferences/
  • Connected iDevices: ~/Library/Preferences/
  • iTunes Preferences: ~/Library/Preferences/
  • Preview – Recent Documents: ~/Library/Preferences/
  • Recent Apps: ~/Library/Preferences/
  • Recent Documents: ~/Library/Preferences/
  • Safari preferences: ~/Library/Preferences/
  • Scheduler plist: ~/Library/Preferences/
  • Screensaver plist: ~/Library/Preferences/
  • Spotlight – User’s search: ~/Library/Preferences/
  • Appstore – AppleID: ~/Library/Preferences/
  • Appstore – Last Auth Time: ~/Library/Preferences/
  • Appstore Preferences: ~/Library/Preferences/
  • Terminal preferences: ~/Library/Preferences/
  • Textedit – Recent documents: ~/Library/Preferences/
  • User Keychains: ~/Library/Keychains/
  • User Autorun: ~/Library/LaunchAgents/
  • User Logs: ~/Library/Logs/

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s