Mac Forensic Part 6 (Mountain Lion 10.8 – Logs)

Application Firewall

  • /private/var/log/appfirewall.log
  • /private/var/log/appfirewall.log.[x].bz2

System Logs

  • /private/var/log/asl/YYYY.MM.DD.U[XX].asl
  • /private/var/log/DiagnosticMessages/YYYY.MM.DD.asl
  • /private/var/log/install.log
  • /private/var/log/install.log.[x].bz2
  • /private/var/log/opendirectoryd.log
  • /private/var/log/opendirectoryd.log.[x].bz2
  • /private/var/log/system.log
  • /private/var/log/system.log.[x].bz2
  • /private/var/log/vnetlib
  • /private/var/log/weekly.out
  • /private/var/log/zzz.log

Last shutdown logs

  • /private/var/log/com.apple.launchd/launchd-shutdown.system.log
  • /private/var/log/com.apple.launchd/launchd-shutdown.system.log

System setup information (if available)

a. wirelessconnection
b. registered country and city
c. firmware version at logged time
d. created username
e. Install apps

  • /private/var/log/install.log

Disk status (at logged time)

  • /private/var/log/daily.out MAC address/

Untitled1

Network Status (at logged time)

  • /private/var/log/daily.out

Untitled2

Connecting USB Device
(Look for “USBMSC”)

  • /private/var/log/System.log

Untitled3

Bootup time
(Look for “BOOT_TIME”)

  • /private/var/log/System.log

Untitled4

Proper Shutdown time
(Look for “SHUTDOWN_TIME”)

  • /private/var/log/System.log

Untitled5

User’s Logs

  • ~/Library/Logs/AMRestore.txt
  • ~/Library/Logs/appstore.log
  • ~/Library/Logs/DiagnosticReports/
  • ~Library/Logs/SMSMigrator/SMSMigrator.log
  • ~/Library/Logs/sync/syncservices.log
  • ~/Library/Logs/Ubiquity/[User]/ubiquity-digest.log
  • ~/Library/Logs/Ubiquity/[User]/ubiquity.log

Disc burning log

  • ~/Library/Logs/DiskRecording.log

Untitled6

Disk Utility log

  • ~/Library/Logs/DiskUtility.log

Untitled7

File system log

  • ~/Library/Logs/fsck_hfs.log

VMWare

  • ~/Library/Logs/VMWare
  • ~/Library/Logs/VMWare Fusion/

.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s