Mac Forensics Part 5 (Mountain Lion 10.8 – User Profile)

User Default Folder

  • Deleted files (Trash bin): ~/.Trash/
  • Desktop files: ~/Desktop/
  • Document folder (default): ~/Documents/
  • Download folder (default): ~/Downloads/
  • Library – configurations and settings: ~/Library/
  • Movies folder (default): ~/Movies/
  • Music folder (default): ~/Music/
  • Public – file sharing, if it is enabled: ~/Public

User Profile Artifacts

Bash command history

  • ~/bash_history

SSH connection detail:

  • ~/.ssh/known_hosts

Settings for Apps to access contacts

  • ~/Library/Application Support/com.apple.TCC/TCC.db

CrashReporter – Apps crashed timestamp

  • ~/Library/Application Support/CrashReporter/[App]_[GUID].plist

Untitled1

CrashReporter – Crash count

  • ~/Library/Application Support/User_Crash_History_[GUID].plist

Untitled2

Dock – Apps appear/Keep in Dock

  • ~/Library/Application Support/Dock/[GUID].db

Notification Center

  • ~/Library/Application Support/NotificationCenter/[GUID].db

Sandbox container

  • ~/Library/Containers/

Keychains (User)

  • ~/Library/Keychains/
  • ~/Library/Keychains/login.keychain
  • ~/Library/Keychains/metadata.keychain
  • ~/Library/Keychains/[XXXX].keychain

LaunchAgents (User)

  • ~/Library/LaunchAgents/[App].plist

Untitled3

Quicktime – URL to online multimedia

  • ~/Library/Caches/Quicktime/downloads/TOC.plist

Untitled4

Recent folders

  • ~/Library/Preferences/com.apple.finder.plist

Untitled5

Language

  • ~/Library/Preferences/.GlobalPreferences.plist

Untitled6

AppStore – available update

  • ~/Library/Preferences/com.apple.appstore.plist

Untitled7

Recent disk image (ISO/DMG)

  • ~/Library/Preferences/com.apple.DiskUtility.plist

Untitled8

Dock – Persistent apps

  • ~/Library/Preferences/com.apple.dock.plist

Untitled9

Dock – Other persistent items

  • ~/Library/Preferences/com.apple.dock.plist

Untitled10

Dashboard – gadget/widget

  • ~/Library/Preferences/com.apple.dashboard.plist

Untitled11

Recent Applications * Default is 10

  • ~/Library/Preferences/com.apple.recentitems.plist

Untitled12

Recent Documents * Default is 10

  • ~/Library/Preferences/com.apple.recentitems.plist

Untitled13

Scheduler

  • ~/Library/Preferences/com.apple.scheduler.plist

Untitled14

Screensaver – Password enabled

  • ~/Library/Preferences/com.apple.screensaver.plist

Untitled15

Finder Sidebar

  • ~/Library/Preferences/com.apple.sidebarlists.plist

Spaces

  • ~/Library/Preferences/com.apple.spaces.plist

Printers

  • ~/Library/Printers/

Connected iDevices

a) Type of device
b) Last connected timestamp
c) Firmware version
d) Serial number and IMEI

  • ~/Library/Preferences/com.apple.iPod.plist Connected storage ~/Library/Preferences/com.apple.sidebarlists.plist

Untitled16

Connected storage

  • ~/Library/Preferences/com.apple.sidebarlists.plist

Untitled17

Flash Cookies

  • ~/Library/Preferences/Macromedia/Flash Player/

Last Used Printers

  • ~/Library/Preferences/org.cups.PrintingPrefs.plist

Untitled18

Preview – Recent Documents

  • ~/Library/Preferences/com.apple.Preview.plist

Untitled19

Quicktime – Recent documents

  • ~/Library/Preferences/com.apple.QuickTimePlayerX.LSSharedFileList.plist

Untitled20

Console – Recent documents

  • ~/Library/Preferences/com.apple.Console.LSSharedFileList

Untitled21

Textedit – Recent documents

  • ~/Library/Preferences/com.apple.TextEdit.LSSharedFileList.plist

Untitled22

Saved Application Stated

– folders of application’s saved state

  • ~/Library/Saved Application State/

RSS

  • ~/Library/PubSub/Database/Database.sqlite3
  • ~/Library/PubSub/Clients.plist
  • ~/Library/PubSub/Feeds/

Spotlight folder

  • ~/.Spotlight-V100/

Download Quarantine Events

  • ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s