Mac OSX Forensic (Mini-Series 4) – 10.8 User Folder

User folder in OS X 10.8 (Mountain Lion) is the same like other version of OS X 10. This folder contain most of the login user’s activities on a Mac system. Among the wealth of information in this folder are the user’s preferences. In a default user folder, you are likely to find the following folders/files:

  • Desktop
  • Documents
  • Downloads
  • Library: hidden folder containing preferences
  • Movies
  • Music
  • Pictures
  • Public
  • Trash: User trash folder before they are remove from the system
  • .bash_history: Terminal command history

Some of important files include:

  • General preferences for user: ~/Library/Preferences/.GlobalPreferences.plist
  • AddressBook preferences: ~/Library/Preferences/com.apple.AddressBook.plist
  • Desktop Service: ~/Library/Preferences/com.apple.desktopservices.plist
  • Dock – Apps keep in Docks (presistent-apps): ~/Library/Preferences/com.apple.com.apple.dock.plist
  • Finder preferences: ~/Library/Preferences/com.apple.finder.plist
  • Finder – Recent folders: ~/Library/Preferences/com.apple.finder.plist
  • iCal preferences: ~/Library/Preferences/com.apple.iCal.plist
  • Facetime – Account: ~/Library/Preferences/com.apple.imservice.FaceTime.plist
  • iMessage – Account: ~/Library/Preferences/com.apple.imservice.iMessage.plist
  • iPhoto preferences: ~/Library/Preferences/com.apple.iPhoto.plist
  • Connected iDevices: ~/Library/Preferences/com.apple.iPod.plist
  • iTunes Preferences: ~/Library/Preferences/com.apple.iTunes.plist
  • Preview – Recent Documents: ~/Library/Preferences/com.apple.Preview.LSSharedFileList
  • Recent Apps: ~/Library/Preferences/com.apple.recentitems.plist
  • Recent Documents: ~/Library/Preferences/com.apple.recentitems.plist
  • Safari preferences: ~/Library/Preferences/com.apple.Safari.plist
  • Scheduler plist: ~/Library/Preferences/com.apple.scheduler.plist
  • Screensaver plist: ~/Library/Preferences/com.apple.screensaver.plist
  • Spotlight – User’s search: ~/Library/Preferences/com.apple.spotlight.plist
  • Appstore – AppleID: ~/Library/Preferences/com.apple.storeagent.plist
  • Appstore – Last Auth Time: ~/Library/Preferences/com.apple.storeagent.plist
  • Appstore Preferences: ~/Library/Preferences/com.apple.storeagent.plist
  • Terminal preferences: ~/Library/Preferences/com.apple.Terminal.plist
  • Textedit – Recent documents: ~/Library/Preferences/com.apple.TextEdit.LSSharedFileList
  • User Keychains: ~/Library/Keychains/
  • User Autorun: ~/Library/LaunchAgents/
  • User Logs: ~/Library/Logs/
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s