SYSTEM ARTIFACTS |
||
Artifact |
Name |
Path |
Autorun Locations |
||
Library Launch Agents |
LaunchAgents |
/Library/LaunchAgents/ |
Library Launch Daemons |
LaunchDaemons |
/Library/LaunchDaemons/ |
Library Startup Items |
StartupItems |
/Library/StartupItems/ |
System Launch Daemons |
LaunchDaemons |
/System/Library/LaunchDaemons/ |
System Startup Items |
StartupItems |
/System/Library/StartupItems/ |
Misc. |
||
Misc. Logs |
log |
/var/log/ |
Misc. Logs |
Logs |
/Library/Logs/ |
Login Window Info |
com.apple.loginwindow.plist |
/Library/Preferences/com.apple.loginwindow.plist |
Bluetooth Preferences |
com.apple.Bluetooth.plist |
/Library/Preferences/com.apple.Bluetooth.plist |
Software Update |
com.apple.SoftwareUpdate.plist |
/Library/Preferences/com.apple.SoftwareUpdate.plist |
Time Machine Info |
com.apple.TimeMachine.plist |
/Library/Preferences/com.apple.TimeMachine.plist |
Remembered Wireless
Networks |
com.apple.airport.preferences.plist |
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist |
OS Version Plist |
SystemVersion;plist |
/System/Library/CoreServices/SystemVersion.plist |
User Setup Plist |
.AppleSetupDone |
/private/var/db/.AppleSetupDone |
Mobile Backups
Directory |
MobileBackups |
/Volumes/MobileBackups/ |
Applications |
Applications |
/Applications/ |
Networking |
||
Hosts file |
hosts |
/etc/hosts |
Remembered Wireless
Networks |
com.apple.airport.preferences.plist |
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist |
Network Time Protocol (NTP) Validation Logs |
||
Hostconfig FIle |
hostconfig |
/private/etc/hostconfig |
NTP Config File |
ntp.conf |
/private/etc/ntp.conf |
NTP Drift File |
ntp.drift |
/private/var/run/ntp.drift |
Sleep State Logs |
||
Directory Service
Server Log |
DirectoryService.server.log |
/Library/Logs/DirectoryService/DirectoryService.server.log |
Apple System Log |
asl.log |
/private/var/log/asl.log |
USER ARTIFACTS |
||
Downloads Directory |
Downloads |
/Users/$USERNAME/Downloads/ |
Documents Directory |
Documents |
/Users/$USERNAME/Documents/ |
Music Directory |
Music |
/Users/$USERNAME/Music/ |
Desktop Directory |
Desktop |
/Users/$USERNAME/Desktop/ |
Library Directory |
Library |
/Users/$USERNAME/Library/ |
Movies Directory |
Movies |
/Users/$USERNAME/Movies/ |
Pictures Directory |
Pictures |
/Users/$USERNAME/Pictures/ |
Public Directory |
Public |
/Users/$USERNAME/Public/ |
Sites Directory |
Sites |
/Users/$USERNAME/Sites/ |
Applications |
Applications |
/Users/$USERNAME/Applications/ |
Safari |
||
Safari Bookmarks |
Bookmarks.plist |
/Users/$USERNAME/Library/Safari/Bookmarks.plist |
Safari Downloads |
Downloads.plist |
/Users/$USERNAME/Library/Safari/Downloads.plist |
Safari Installed
Extensions |
Extensions.plist |
/Users/$USERNAME/Library/Safari/Extensions/Extensions.plist |
Safari Extensions |
Extensions |
/Users/$USERNAME/Library/Safari/Extensions/ |
Safari History |
History.plist |
/Users/$USERNAME/Library/Safari/History.plist |
Safari History Index |
HistoryIndex.sk |
/Users/$USERNAME/Library/Safari/HistoryIndex.sk |
Safari Last Session |
LastSession.plist |
/Users/$USERNAME/Library/Safari/LastSession.plist |
Safari Local Storage
Directory |
LocalStorage |
/Users/$USERNAME/Library/Safari/LocalStorage/ |
Safari Local Storage
Database |
/Users/$USERNAME/Library/Safari/LocalStorage/StorageTracker.db |
|
Safari Saved Desktop
Image |
Safari Desktop Picture.jpg |
/Users/$USERNAME/Library/Safari/Saved Desktop
Picture.jpg |
Safari Top Sites |
TopSites.plist |
/Users/$USERNAME/Library/Safari/TopSites.plist |
Safari Webpage Icons
Database |
/Users/$USERNAME/Library/Safari/WebpageIcons.db |
|
Safari Webpage
Databases |
Databases |
/Users/$USERNAME/Library/Safari/Databases/ |
Safari Webpage
Databases Database |
/Users/$USERNAME/Library/Safari/Databases/Databases.db |
|
Safari Cache Directory |
com.apple.Safari |
/Users/$USERNAME/Library/Caches/com.apple.Safari/ |
Safari Cache |
/Users/$USERNAME/Library/Caches/com.apple.Safari/Cache.db |
|
Safari Extensions
Cache |
Extensions |
/Users/$USERNAME/Library/Caches/com.apple.Safari/Extensions/ |
Safari Webpage
Previews |
Webpage Previews |
/Users/$USERNAME/Library/Caches/com.apple.Safari/Webpage
Previews/ |
Safari Cookies |
Cookies.plist |
/Users/$USERNAME/Library/Cookies/Cookies.plist |
Safari Preferences |
com.apple.Safari.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Safari.plist |
Safari Saved
Application State Directory |
com.apple.Safari.savedState |
/Users/$USERNAME/Library/Saved Application
State/com.apple.Safari.savedState/ |
Safari Bookmark Cache |
Bookmarks |
/Users/$USERNAME/Library/Caches/Metadata/Safari/Bookmarks/ |
Safari History Cache |
History |
/Users/$USERNAME/Library/Caches/Metadata/Safari/History/ |
Mail |
||
Mail Cache |
Cache.db |
/Users/$USERNAME/Library/Caches/com.apple.Mail/Cache.db |
Mail Mailbox Directory |
Mailboxes |
/Users/$USERNAME/Library/Mail/V2/Mailboxes/ |
Mail IMAP Synched
Mailboxes |
IMAP-<name@address> |
/Users/$USERNAME/Library/Mail/V2/IMAP-<name@address> |
Mail POP Synched
Mailboxes |
POP-<name@address> |
/Users/$USERNAME/Library/Mail/V2/POP-<name@address> |
Mail BackupTOC |
BackupTOC.plist |
/Users/$USERNAME/Library/Mail/V2/MailData/BackupTOC.plist |
Mail Envelope Index |
Envelop Index |
/Users/$USERNAME/Library/Mail/V2/MailData/Envelope
Index |
Mail Opened
Attachments |
OpenedAttachments.plist |
/Users/$USERNAME/Library/Mail/V2/MailData/OpenedAttachments.plist |
Mail Search History |
SearchHistory.plist |
/Users/$USERNAME/Library/Mail/V2/MailData/SearchHistory.plist |
Mail Signatures by
Account |
SignaturesByAccount.plist |
/Users/$USERNAME/Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plist |
Mail Smart Mailbox
Info |
SmartMailboxes.plist |
/Users/$USERNAME/Library/Mail/V2/MailData/SmartMailboxes.plist |
Mail RSS Feeds |
RSS |
/Users/$USERNAME/Library/Mail/V2/RSS/ |
Mail Downloads
Directory |
Mail Downloads |
/Users/$USERNAME/Library/Mail Downloads/ |
Mail Preferences |
com.apple.Mail.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Mail.plist |
Mail Recent Contacts |
MailRecents-v4.abcdmr |
/Users/$USERNAME/Library/Application
Support/Address Book/MailRecents-v4.abcdmr |
iChat |
||
iChat Preferences |
com.apple.iChat.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iChat.plist |
Saved Chats |
iChats |
/Users/$USERNAME/Documents/iChats/ |
Icon |
Pictures |
/Users/$USERNAME/Library/Caches/com.apple.iChat/Pictures |
Recent Pictures |
iChat Recent Pictures |
/Users/$USERNAME/Library/Images/iChat Recent
Pictures/ |
iChat AIM Plist |
com.apple.iChat.AIM.plist |
|
iChat Jabber Plist |
com.apple.iChat.Jabber.plist |
|
iChat Yahoo Plist |
com.apple.iChat.Yahoo.plist |
|
iChat Status Messages
Plist |
com.apple.iChat.StatusMessages.plist |
|
iChat PubSub Plist |
com.apple.iChat.PubSub.plist |
|
iPhoto |
||
iPhoto Library |
iPhoto Library |
/Users/$USERNAME/Pictures/iPhoto Library |
Original Photos |
Originals |
/Users/$USERNAME/Pictures/iPhoto
/Library/Originals/ |
Modified Photos |
Modified |
/Users/$USERNAME/Pictures/iPhoto
/Library/Modified/ |
iPhoto Main Database |
/Users/$USERNAME/Pictures/iPhoto
/Library/iPhotoMain.db |
|
iDevice Photo Cache |
iPod Photo Cache |
/Users/$USERNAME/Pictures/iPhoto /Library/iPod
Photo Cache/ |
Face Recognition
Artifacts |
face.db, face_blob.db |
/Users/$USERNAME/Pictures/iPhoto /Library/ |
Album Data |
AlbumData.xml |
/Users/$USERNAME/Pictures/iPhoto
/Library/AlbumData.xml |
Album Data 2 |
AlbumData2.xml |
/Users/$USERNAME/Pictures/iPhoto
/Library/AlbumData2.xml |
iPhoto Spotlight File |
iPhoto.ipspot |
/Users/$USERNAME/Pictures/iPhoto
/Library/iPhoto.ipspot |
iPhoto Recent Items |
com.apple.iPhoto.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iPhoto.LSSharedFileList.plist |
iPhoto Preferences |
com.apple.iPhoto.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iPhoto.plist |
iTunes |
||
iTunes Preferences |
com.apple.iTunes.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iTunes.plist |
iTunes Library
Directory |
iTunes |
/Users/$USERNAME/Music/iTunes/ |
iTunes Media |
iTunes Media |
/Users/$USERNAME/Music/iTunes/iTunes Media/ |
iTunes Library
Structure |
iTunes Music Library.xml |
/Users/$USERNAME/Music/iTunes/iTunes Music
Library.xml |
Photo Booth |
||
Recent Pictures |
Recents.plist |
/Users/$USERNAME/Pictures/Photo Booth
/Library/Recents.plist |
Photo Booth Pictures
Directory |
Pictures |
/Users/$USERNAME/Pictures/Photo Booth
/Library/Pictures/ |
Cache |
com.apple.PhotoBooth |
/Users/$USERNAME/Library/Caches/com.apple.PhotoBooth/ |
Photo Booth
Preferences |
com.apple.PhotoBooth.plist |
/Users/$USERNAME/Library/Preferences/com.apple.PhotoBooth.plist |
Address Book |
||
Address Book Database |
AddressBook-v22.abcddb |
/Users/$USERNAME/Library/Application
Support/Address Book/AddressBook-v22.abcddb |
Address Book Last
Configuration Fetch |
com.apple.AddressBook.abd.plist |
/Users/$USERNAME/Library/Preferences/com.apple.AddressBook.abd.plist |
Address Book
Preferences |
com.apple.AddressBook.plist |
/Users/$USERNAME/Library/Preferences/com.apple.AddressBook.plist |
Spotlight |
||
Spotlight Directory |
.Spotlight-V100 |
/Users/$USERNAME/.Spotlight-V100/ |
Shutdown Time |
shutdown_time |
/Users/$USERNAME/.Spotlight-V100/Store-V<#>/<GUID>/shutdown_time |
RSS |
||
RSS Feeds Database |
Database.sqlite3 |
/Users/$USERNAME/Library/PubSub/Database/Database.sqlite3 |
RSS Feed Plist |
Clients.plist |
/Users/$USERNAME/Library/PubSub/Clients.plist |
Feeds Directory |
Feeds |
/Users/$USERNAME/Library/PubSub/Feeds/ |
Mail RSS Mailbox
Directory |
RSS |
/Users/$USERNAME/Library/Mail/V2/RSS/ |
Saved Application State |
||
Saved Application
State Directory |
Saved Application State |
/Users/$USERNAME/Library/Saved Application
State/ |
Saved Application
Window Plist |
Windows.plist |
/Users/$USERNAME/Library/Saved Application
State/<application.savedState>/Windows.plist |
Preferences |
||
Preferences Directory |
Preferences |
/Users/$USERNAME/Library/Preferences/ |
Global Preferences |
.GlobalPreferences.plist |
/Users/$USERNAME/Library/Preferences/.GlobalPreferences.plist |
Photo Booth
Preferences |
com.apple.PhotoBooth.plist |
/Users/$USERNAME/Library/Preferences/com.apple.photobooth.plist |
Microsoft Office
Preferences and Recent Items |
com.microsoft.office.plist |
/Users/$USERNAME/Library/Preferences/com.microsoft.office.plist |
Calculator Preferences |
com.apple.Calculator.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Calculator.plist |
Dashboard Preferences |
com.apple.Dashboard.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Dashboard.plist |
Desktop Preferences |
com.apple.Desktop.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Desktop.plist |
Disk Utility
Preferences |
com.apple.DiskUtility.plist |
/Users/$USERNAME/Library/Preferences/com.apple.DiskUtility.plist |
Dock Preferences |
com.apple.Dock.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Dock.plist |
Finder Preferences |
com.apple.Finder.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Finder.plist |
iCal Preferences |
com.apple.iCal.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iCal.plist |
iChat Preferences |
com.apple.iChat.plist |
/Users/$USERNAME/Library/Preferences/com.iChat.plist |
iMovie Preferences |
com.apple.iMovie8.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iMovie8.plist |
iPhoto Preferences |
com.apple.iPhoto.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iPhoto.plist |
iWeb Preferences |
com.apple.iWeb.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iWeb.plist |
iTunes Preferences |
com.apple.iTunes.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iTunes.plist |
OnyX Preferences |
com.apple.OnyX.plist |
/Users/$USERNAME/Library/Preferences/com.OnyX.plist |
KisMAC Preferences |
org.kismac-ng.kismac.plist |
/Users/$USERNAME/Library/Preferences/org.kismac-ng.kismac.plist |
Black Hole System
Cleaner Preferences |
net.irradiated.Black-Hole.plist |
/Users/$USERNAME/Library/Preferences/net.irradiated.Black-Hole.plist |
AOL Instant Messenger
Preferences |
com.aol.aim.desktop.plist |
/Users/$USERNAME/Library/Preferences/com.aol.aim.desktop.plist |
Keychain Preferences |
com.apple.keychainaccess.plist |
/Users/$USERNAME/Library/Preferences/com.apple.keychainaccess.plist |
Address Book
Preferences |
com.apple.AddressBook.plist |
/Users/$USERNAME/Library/Preferences/com.apple.AddressBook.plist |
iApps Database
Preferences |
com.apple.iApps.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iApps.plist |
Sidebar Lists
Preferences |
com.apple.sidebarlists.plist |
/Users/$USERNAME/Preferences/com.apple.sidebarlists.plist |
Autorun Locations |
||
Login Window |
loginwindow.plist |
/Users/$USERNAME/Library/Preferences/loginwindow.plist |
Login Items |
com.apple.LoginItems.plist |
/Users/$USERNAME/Library/Preferences/com.apple.loginitems.plist |
Recent Items |
||
Preview Recent Items |
com.apple.Preview.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Preview.LSSharedFileList.plist |
Property List Editor
Recent Items |
com.apple.PropertyListEditor.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.PropertyListEditor.LSSharedFileList.plist |
QuickTime Recent Items |
com.apple.QuickTimePlayerX.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.QuickTimePlayerX.LSSharedFileList.plist |
Recent Items |
com.apple.RecentItems.plist |
/Users/$USERNAME/Library/Preferences/com.apple.recentitems.plist |
Screen Sharing Recent
Shares |
com.apple.ScreenSharing.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.ScreenSharing.LSSharedFileList.plist |
TextEdit Recent Items |
com.apple.TextEdit.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.TextEdit.LSSharedFileList.plist |
VLC Video Player
Recent Items |
org.videolan.vlc.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/org.videolan.vlc.LSSharedFileList.plist |
Grab Screen Shot
Recent Items |
com.apple.Grab.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Grab.LSSharedFileList.plist |
Console Recent Items |
com.apple.Console.LSSharedFileList.plist |
/Users/$USERNAME/Library/Preferences/com.apple.Console.LSSharedFileList.plist |
Misc. |
||
Logs Directory |
Logs |
/Users/$USERNAME/Library/Logs/ |
Dock database |
/Users/$USERNAME/Library/Preferences/com.apple.Dock.db |
|
Attached iDevices |
com.apple.iPod.plist |
/Users/$USERNAME/Library/Preferences/com.apple.iPod.plist |
Launch Service
Quarantine Events |
com.apple.LaunchServices.QuarantineEvents |
/Users/$USERNAME/Library/Preferences/com.apple.LaunchServices.QuarantineEvents |
Terminal Commands
History |
.bash_history |
/Users/$USERNAME/.bash_history |
Owner Information
Plist |
AddressBookMe.plist |
/Users/$USERNAME/Library/Preferences/AddressBookMe.plist |
Application Support
Directory |
Application Support |
/Users/$USERNAME/Library/Application Support/ |
Keychain Directory |
Keychains |
/Users/$USERNAME/Library/Keychains/ |
Trash |
.Trash |
/Users/$USERNAME/.Trash/ |
Flash Shared Objects |
#SharedObjects |
/Users/$USERNAME/Preferences/Macromedia/Flash
Player/#SharedObjects/ |
Flash Player Support |
sys |
/Users/$USERNAME/Preferences/Macromedia/Flash
Player/support/flash player/sys/ |
CD Information
Database |
CD Info.cidb |
/Users/$USERNAME/Preferences/CD Info.cidb |
Document Revisions
Directory |
.DocumentRevisions-V100 |
/Users/$USERNAME/.DocumentRevisions-V100/ |
Sleep
Image File |
sleepimage |
/var/vm/sleepimage |
Swap Files |
swapfile# |
/var/vm/swapfile# |
User
Log In Password Hash Plist |
<user
name>.plist |
/var/db/dslocal/nodes/Default/users/
|
Firefox |
||
Firefox Directory |
Firefox |
/Users/$USERNAME/Library/Application
Support/Firefox/ |
Firefox Profiles |
Profiles |
/Users/$USERNAME/Library/Application
Support/Firefox/Profiles/ |
Firefox Cookies |
Cookies.sqlite |
/Users/$USERNAME/Library/Application
Support/Firefox/Profiles/<profile>/Cookies.sqlite |
Firefox Downloads |
Downloads.sqlite |
/Users/$USERNAME/Library/Application
Support/Firefox/Profiles/<profile>/Downloads.sqlite |
Firefox Form History |
Formhistory.sqlite |
/Users/$USERNAME/Library/ApplicationSupport/Firefox/Profiles/<profile>/Formhistory.sqlite |
Firefox History |
Places.sqlite |
/Users/$USERNAME/Library/ApplicationSupport/Firefox/Profiles/<profile>/Places.sqlite |
Google Chrome |
||
Chrome Directory |
Chrome |
/Users/$USERNAME/Library/Application
Support/Google/Chrome/ |
Chrome Cache |
com.google.chrome |
/Users/$USERNAME/Library/Caches/com.google.Chrome/ |
Preference Files |
com.google.Chrome.plist |
/Users/$USERNAME/Library/Preferences/com.google.Chrome.plist |
Chrome Helper File |
com.google.Chrome.helper.plst |
/Users/$USERNAME/Library/Preferences/com.google.Chrome.helper.plist |
Chrome Update Plist |
com.google.Keystone.Agent.plist |
/Users/$USERNAME/Library/Preferences/com.google.Keystone.Agent.plist |
Tor |
||
Hidden Tor Directory |
.tor |
/Users/$USERNAME/.tor |
State File |
State |
/Users/$USERNAME/.tor/State |
VirtualBox |
||
VirtuaBox Directory |
VirtualBox |
/Users/$USERNAME/Library/VirtualBox/ |
VirtualBox Settings |
VirtualBox.xml |
/Users/$USERNAME/Library/VirtualBox/VirtualBox.xml |
VirtualBox Log File |
VBoxSVC.log |
/Users/$USERNAME/Library/VirtualBox/VBoxSVC.log |
VirtualBox Cache
Directory |
org.virtualbox.app.VirtualBox |
/Users/$USERNAME/Library/Caches/org.virtualbox.app.VirtualBox/ |
VirtualBox VM
Directory |
VirtualBox VMs |
/Users/$USERNAME/VirtualBox VMs/ |
Drop Box |
||
Shared Folder |
Dropbox |
/Users/$USERNAME/Dropbox |
Drop Box Cache Folder |
com.getdropbox.dropbox |
/Users/$USERNAME/Library/Caches/com.getdropbox.dropbox |
Drop Box Config Folder |
.dropbox |
/Users/$USERNAME/.dropbox/ |
Drop Box Config
Database |
/Users/$USERNAME/.dropbox/Config.db |
|
Drop Box File Cache |
/Users/$USERNAME/.dropbox/filecache.db |
|
Skype |
||
Skype Directory |
Skype |
/Users/$USERNAME/Library/Application
Support/Skype/ |
User profile |
<Skype user name> |
/Users/$USERNAME/Library/Application
Support/Skype/<Skype user name>/ |
Skype Preferences and
Recent Searches |
com.skype.skype.plist |
/Users/$USERNAME/Library/Preferences/com.skype.skype.plist |
Main Skype database |
/Users/$USERNAME/Library/Application
Support/Skype/<Skype user name>/Main.db |
|
Chat Sync Directory |
chatsync |
/Users/$USERNAME/Library/Application
Support/Skype/<Skype user name>/chatsync/ |
Handbrake DVD Ripper |
||
Handbrake Directory |
Handbrake |
/Users/$USERNAME/Library/Application
Support/Handbrake/ |
Logs |
EncodeLogs |
/Users/$USERNAME/Library/Application
Support/Handbrake/EncodeLogs/ |
Activity Log |
HandBrake-activtylog.txt |
/Users/$USERNAME/Library/Application
Support/Handbrake/HandBrake-activitylog.txt |
Queue |
Queue.plist |
/Users/$USERNAME/Library/Application
Support/Handbrake/Queue.plist |
Previews Directory |
Previews |
/Users/$USERNAME/Library/Application
Support/Handbrake/Previews/ |
Preferences & Last
Launch |
org.m0k.handbrake.plist |
/Users/$USERNAME/Library/Preferences/org.m0k.handbrake.plist |
|
||
Twitter Preferences |
com.twitter.twitter-mac.plist |
/Users/$USERNAME/Library/Preferences/com.twitter.twitter-mac.plist |
Application |
Twitter |
/Applications/Twitter.app/ |
Twitter Cache
Directory |
com.twitter.twitter-mac |
/Users/$USERNAME/Library/Caches/com.twitter.twitter-mac |
Twitter cache file |
/Users/$USERNAME/Library/Caches/com.twitter.twitter-mac/Cache.db |
|
Twitter Saved
Application State Directory |
com.twitter.twitter-mac.savedState |
/Users/$USERNAME/Library/Saved Application
State/com.twitter.twitter-mac.savedState |
iCloud |
||
iCloud Accounts |
Accounts |
/Users/$USERNAME/Library/iCloud/Accounts/ |
Adium Chat Client |
||
Chat Transcripts |
Logs |
/Users/$USERNAME/Library/Application
Support/Adium 2.0/Users/Default/Logs/ |
CleanMyMac |
||
Preferences and
Settings |
com.macpaw.CleanMyMac.plist |
/Users/$USERNAME/Library/Preferences/com.macpaw.CleanMyMac.plist |
Evernote |
||
Evernote Application
Support Directory |
Evernote |
/Users/$USERNAME/Library/Application
Support/Evernote/ |
Evernote Data/Profile
Directory |
data |
/Users/$USERNAME/Library/Application
Support/Evernote/data/ |
Evernote Logs |
logs |
/Users/$USERNAME/Library/Application
Support/Evernote/logs/ |
Evernote Profile Info |
Evernote.sql |
/Users/$USERNAME/Library/Application
Support/Evernote/data/<profile>/Evernote.sql |
Evernote User Content |
Content |
/Users/$USERNAME/Library/Application
Support/Evernote/data/<profile>/Content/ |
Bugünkü blog yazımda Mac OS X işletim sisteminde yer alan Artifactlerin neler olduğu ve hangi alanlarda ne tür veriler barındırdığı ile ilgili bilgi veriyor olacağım.
Manuel yöntemler veya otomatik yazılımlar ile Macbook incelemesi yaparken analiz hızınızı arttıracak Artifact listesini, aşağıda yer alan tablo üzerinde sizlere sunmuş bulunuyorum.
Umarım siz değerli Adli Bilişim Araştırmacıları için faydalı bir gönderi olur.
Not: Adli Bilişim ile ilgili paylaşımların bulunduğu Adli Bilişim Türkiye Telegram grubuna dahil olmak için buradaki linke tıklayabilir ya da telegramda @AdliBilisimTurkiye yazarak kanalımıza ulaşabilirsiniz.