Mac OS X Forensic Artifacts
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
Comment only
 
 
ABCDEFG
1
OS X Lion Artifacts By: mac4n6 group@pstirparo
2
Last Modified: 19 Dec 2011 (original file of Sean Cavanaugh)
3
Acknowledgements: big thank to Sean Cavanaugh who first started this with "OSX Lion Artifacts" shared spreadsheet
4
5
Legend
6
To be verified
7
Verified
8
Wrong / Missing from this version
9
New from this version
10
11
12
SYSTEM ARTIFACTS
13
ArtifactNameLabelsPathNotes
14
15
Autorun Locations
16
Library Launch AgentsLaunchAgents/Library/LaunchAgents/
17
Library Launch DaemonsLaunchDaemons/Library/LaunchDaemons/
18
Library Startup ItemsStartupItems/Library/StartupItems/
19
System Launch DaemonsLaunchDaemons/System/Library/LaunchDaemons/
20
System Startup ItemsStartupItems/System/Library/StartupItems/
21
22
23
Misc.
24
Misc. Logslog/var/log/
25
Misc. LogsLogs/Library/Logs/
26
Login Window Infocom.apple.loginwindow.plist/Library/Preferences/com.apple.loginwindow.plistPlist containing password hints and last user logged in
27
Bluetooth Preferencescom.apple.Bluetooth.plist/Library/Preferences/com.apple.Bluetooth.plistBluetooth preferences and paired devices
28
Software Update com.apple.SoftwareUpdate.plist/Library/Preferences/com.apple.SoftwareUpdate.plistPlist describing last attempt and last successful attempt at updating OS X software
29
Time Machine Infocom.apple.TimeMachine.plist/Library/Preferences/com.apple.TimeMachine.plistTime Machine backup info
30
Remembered Wireless Networkscom.apple.airport.preferences.plist/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plistRemembered wireless networks
31
OS Version PlistSystemVersion;plist/System/Library/CoreServices/SystemVersion.plistPlist describing the installed Operating System
32
User Setup Plist.AppleSetupDone/private/var/db/.AppleSetupDonePlist listing the information entered by the user at the time of the OS setup
33
Mobile Backups DirectoryMobileBackups/Volumes/MobileBackups/Local Time Machine backup directory stored on disk. Time Machine backups are created and stored here when Time Machine backup disk is not available.
34
ApplicationsApplications/Applications/Not user-specific
35
36
Networking
37
Hosts filehosts/etc/hosts
38
Remembered Wireless Networkscom.apple.airport.preferences.plist/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plistRemembered wireless networks
39
40
Network Time Protocol (NTP) Validation Logs
41
Hostconfig FIlehostconfig/private/etc/hostconfig
42
NTP Config Filentp.conf/private/etc/ntp.conf
43
NTP Drift Filentp.drift/private/var/run/ntp.drift
44
45
Sleep State Logs
46
Directory Service Server LogDirectoryService.server.log/Library/Logs/DirectoryService/DirectoryService.server.log
47
Apple System Logasl.log/private/var/log/asl.log
48
49
50
USER ARTIFACTS
51
ArtifactNamePathNotes
52
53
User Directories
54
Downloads DirectoryDownloads/Users/$USERNAME/Downloads/
55
Documents DirectoryDocuments/Users/$USERNAME/Documents/
56
Music DirectoryMusic/Users/$USERNAME/Music/
57
Desktop DirectoryDesktop/Users/$USERNAME/Desktop/
58
Library DirectoryLibrary/Users/$USERNAME/Library/Hidden directory in Lion
59
Movies DirectoryMovies/Users/$USERNAME/Movies/
60
Pictures DirectoryPictures/Users/$USERNAME/Pictures/
61
Public DirectoryPublic/Users/$USERNAME/Public/
62
Sites DirectorySites/Users/$USERNAME/Sites/
63
ApplicationsApplications/Users/$USERNAME/Applications/
64
65
66
67
68
69
70
APPLICATIONS ARTIFACTS
71
ArtifactNamePathNotes
72
73
74
75
76
77
OS X Lion Artifacts STILL TO BE ARRANGED from the original spreadsheet of Sean Cavanaugh
78
ArtifactNamePathNotes
79
80
Safari
81
Safari BookmarksBookmarks.plist/Users/$USERNAME/Library/Safari/Bookmarks.plistPlist listing default and user-added Safari bookmarks
82
Safari DownloadsDownloads.plist/Users/$USERNAME/Library/Safari/Downloads.plistPlist listing files downloaded using Safari Browser
83
Safari Installed ExtensionsExtensions.plist/Users/$USERNAME/Library/Safari/Extensions/Extensions.plistPlist describing installed Safari Extensions
84
Safari ExtensionsExtensions/Users/$USERNAME/Library/Safari/Extensions/Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension.
85
Safari HistoryHistory.plist/Users/$USERNAME/Library/Safari/History.plistPlist listing Safari web browsing history
86
Safari History IndexHistoryIndex.sk/Users/$USERNAME/Library/Safari/HistoryIndex.skAn index of Safari History allowing a user to perform keyword searches of visited webpages
87
Safari Last SessionLastSession.plist/Users/$USERNAME/Library/Safari/LastSession.plistA plist describing the state of Safari when it was last closed
88
Safari Local Storage DirectoryLocalStorage/Users/$USERNAME/Library/Safari/LocalStorage/A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .localstorage.
89
Safari Local Storage DatabaseStorageTracker.db/Users/$USERNAME/Library/Safari/LocalStorage/StorageTracker.dbA database listing the webpage specific databases
90
Safari Saved Desktop ImageSafari Desktop Picture.jpg/Users/$USERNAME/Library/Safari/Saved Desktop Picture.jpgWill persist in directory after desktop picture has been changed to something else
91
Safari Top SitesTopSites.plist/Users/$USERNAME/Library/Safari/TopSites.plistA Plist listing the webpages belonging to a Safari's Top Sites
92
Safari Webpage Icons DatabaseWebpageIcons.db/Users/$USERNAME/Library/Safari/WebpageIcons.dbA database containing saved web page icons for webpages visited
93
Safari Webpage DatabasesDatabases/Users/$USERNAME/Library/Safari/Databases/A directory for webpage-specific database storage
94
Safari Webpage Databases DatabaseDatabases.db/Users/$USERNAME/Library/Safari/Databases/Databases.dbA database that keeps track of stored webpage-specific databases
95
Safari Cache Directorycom.apple.Safari/Users/$USERNAME/Library/Caches/com.apple.Safari/A directory containing Safari-specific cache items
96
Safari CacheCache.db/Users/$USERNAME/Library/Caches/com.apple.Safari/Cache.dbA cache of data from visited webpages
97
Safari Extensions CacheExtensions/Users/$USERNAME/Library/Caches/com.apple.Safari/Extensions/A directory containing cached items for Safari Extensions
98
Safari Webpage PreviewsWebpage Previews/Users/$USERNAME/Library/Caches/com.apple.Safari/Webpage Previews/A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage URL.
99
Safari CookiesCookies.plist/Users/$USERNAME/Library/Cookies/Cookies.plistA Plist containing cookies from visited webpages
100
Safari Preferencescom.apple.Safari.plist/Users/$USERNAME/Library/Preferences/com.apple.Safari.plistContains recent safari search strings and downloads folder location in addition to preferences
Loading...
Main menu