Mac OS X Forensics Artifacts
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
View only
 
 
Still loading...
ABCDEFG
1
OS X Snow Leopard Artifacts By: mac4n6 grouppasquale.stirparo@sefirtech.comWant to add to the list? Email artifact info to pasquale.stirparo@sefirtech.com
2
v0.1 - Last Modified: 10 Feb 2014Twitter: @pstirparo , @sefirtech
3
Acknowledgements: big thank to Sean Cavanaugh who first started this with "OSX Lion Artifacts" shared spreadsheet
4
5
Legend
6
To be verified
7
Verified
8
Wrong / Missing from this version
9
New from this version
10
11
12
13
SYSTEM ARTIFACTS
14
ArtifactNameLabelsPathNotes
15
16
17
18
19
20
21
USER ARTIFACTS
22
ArtifactNameLabelsPathNotes
23
24
25
26
27
28
29
APPLICATIONS ARTIFACTS
30
ArtifactNamePathNotes
31
32
33
OS X Lion Artifacts TO BE VERIFIED AND ARRANGED from the original spreadsheet of Sean Cavanaugh
34
ArtifactNamePathNotes
35
36
User Directories
37
Downloads DirectoryDownloads/Users/$USERNAME/Downloads/
38
Documents DirectoryDocuments/Users/$USERNAME/Documents/
39
Music DirectoryMusic/Users/$USERNAME/Music/
40
Desktop DirectoryDesktop/Users/$USERNAME/Desktop/
41
Library DirectoryLibrary/Users/$USERNAME/Library/Hidden directory in Lion
42
Movies DirectoryMovies/Users/$USERNAME/Movies/
43
Pictures DirectoryPictures/Users/$USERNAME/Pictures/
44
Public DirectoryPublic/Users/$USERNAME/Public/
45
Sites DirectorySites/Users/$USERNAME/Sites/
46
ApplicationsApplications/Users/$USERNAME/Applications/
47
ApplicationsApplications/Applications/Not user-specific
48
49
50
Safari
51
Safari BookmarksBookmarks.plist/Users/$USERNAME/Library/Safari/Bookmarks.plistPlist listing default and user-added Safari bookmarks
52
Safari DownloadsDownloads.plist/Users/$USERNAME/Library/Safari/Downloads.plistPlist listing files downloaded using Safari Browser
53
Safari Installed ExtensionsExtensions.plist/Users/$USERNAME/Library/Safari/Extensions/Extensions.plistPlist describing installed Safari Extensions
54
Safari ExtensionsExtensions/Users/$USERNAME/Library/Safari/Extensions/Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension.
55
Safari HistoryHistory.plist/Users/$USERNAME/Library/Safari/History.plistPlist listing Safari web browsing history
56
Safari History IndexHistoryIndex.sk/Users/$USERNAME/Library/Safari/HistoryIndex.skAn index of Safari History allowing a user to perform keyword searches of visited webpages
57
Safari Last SessionLastSession.plist/Users/$USERNAME/Library/Safari/LastSession.plistA plist describing the state of Safari when it was last closed
58
Safari Local Storage DirectoryLocalStorage/Users/$USERNAME/Library/Safari/LocalStorage/A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .localstorage.
59
Safari Local Storage DatabaseStorageTracker.db/Users/$USERNAME/Library/Safari/LocalStorage/StorageTracker.dbA database listing the webpage specific databases
60
Safari Saved Desktop ImageSafari Desktop Picture.jpg/Users/$USERNAME/Library/Safari/Saved Desktop Picture.jpgWill persist in directory after desktop picture has been changed to something else
61
Safari Top SitesTopSites.plist/Users/$USERNAME/Library/Safari/TopSites.plistA Plist listing the webpages belonging to a Safari's Top Sites
62
Safari Webpage Icons DatabaseWebpageIcons.db/Users/$USERNAME/Library/Safari/WebpageIcons.dbA database containing saved web page icons for webpages visited
63
Safari Webpage DatabasesDatabases/Users/$USERNAME/Library/Safari/Databases/A directory for webpage-specific database storage
64
Safari Webpage Databases DatabaseDatabases.db/Users/$USERNAME/Library/Safari/Databases/Databases.dbA database that keeps track of stored webpage-specific databases
65
Safari Cache Directorycom.apple.Safari/Users/$USERNAME/Library/Caches/com.apple.Safari/A directory containing Safari-specific cache items
66
Safari CacheCache.db/Users/$USERNAME/Library/Caches/com.apple.Safari/Cache.dbA cache of data from visited webpages
67
Safari Extensions CacheExtensions/Users/$USERNAME/Library/Caches/com.apple.Safari/Extensions/A directory containing cached items for Safari Extensions
68
Safari Webpage PreviewsWebpage Previews/Users/$USERNAME/Library/Caches/com.apple.Safari/Webpage Previews/A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage URL.
69
Safari CookiesCookies.plist/Users/$USERNAME/Library/Cookies/Cookies.plistA Plist containing cookies from visited webpages
70
Safari Preferencescom.apple.Safari.plist/Users/$USERNAME/Library/Preferences/com.apple.Safari.plistContains recent safari search strings and downloads folder location in addition to preferences
71
Safari Saved Application State Directorycom.apple.Safari.savedState/Users/$USERNAME/Library/Saved Application State/com.apple.Safari.savedState/
72
Safari Bookmark CacheBookmarks/Users/$USERNAME/Library/Caches/Metadata/Safari/Bookmarks/Each bookmark entry in Bookmarks.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow the user to select the bookmark entry from Spotlight and have Safari launch the corresponding webpage
73
Safari History CacheHistory/Users/$USERNAME/Library/Caches/Metadata/Safari/History/Each website entry in History.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow the user to select the webpage entry from Spotlight and have Safari launch the corresponding webpage
74
75
76
Mail
77
Mail CacheCache.db/Users/$USERNAME/Library/Caches/com.apple.Mail/Cache.dbCached images from email messages
78
Mail Mailbox DirectoryMailboxes/Users/$USERNAME/Library/Mail/V2/Mailboxes/Apple Mail Mailboxs
79
Mail IMAP Synched MailboxesIMAP-<name@address>/Users/$USERNAME/Library/Mail/V2/IMAP-<name@address>Synched IMAP Account(s)
80
Mail POP Synched MailboxesPOP-<name@address>/Users/$USERNAME/Library/Mail/V2/POP-<name@address>Synched POP Account(s)
81
Mail BackupTOCBackupTOC.plist/Users/$USERNAME/Library/Mail/V2/MailData/BackupTOC.plistBackup Plist that defines the mailbox structure
82
Mail Envelope IndexEnvelop Index/Users/$USERNAME/Library/Mail/V2/MailData/Envelope IndexKeeps track of the location of Mail messages - the content of some messages is present as well
83
Mail Opened AttachmentsOpenedAttachments.plist/Users/$USERNAME/Library/Mail/V2/MailData/OpenedAttachments.plistPlist listing opened Mail attachments
84
Mail Search HistorySearchHistory.plist/Users/$USERNAME/Library/Mail/V2/MailData/SearchHistory.plistPlist listing search terms entered into Mail's search box
85
Mail Signatures by AccountSignaturesByAccount.plist/Users/$USERNAME/Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plistPlist containing Mail signatures
86
Mail Smart Mailbox InfoSmartMailboxes.plist/Users/$USERNAME/Library/Mail/V2/MailData/SmartMailboxes.plistSmart Mailbox information
87
Mail RSS FeedsRSS/Users/$USERNAME/Library/Mail/V2/RSS/Directory containing RSS feed mailboxes
88
Mail Downloads DirectoryMail Downloads/Users/$USERNAME/Library/Mail Downloads/Directory containing files downloaded from email messages
89
Mail Preferencescom.apple.Mail.plist/Users/$USERNAME/Library/Preferences/com.apple.Mail.plistMail preferences
90
Mail Recent ContactsMailRecents-v4.abcdmr/Users/$USERNAME/Library/Application Support/Address Book/MailRecents-v4.abcdmrSQLite database stored in Address Book's support directory containing recent Mail contacts
91
92
93
iChat
94
iChat Preferencescom.apple.iChat.plist/Users/$USERNAME/Library/Preferences/com.apple.iChat.plistiChat preferences and user account information
95
Saved ChatsiChats/Users/$USERNAME/Documents/iChats/
96
IconPictures/Users/$USERNAME/Library/Caches/com.apple.iChat/PicturesUser iChat icon
97
Recent PicturesiChat Recent Pictures/Users/$USERNAME/Library/Images/iChat Recent Pictures/Recent user iChat pictures
98
iChat AIM Plistcom.apple.iChat.AIM.plist
99
iChat Jabber Plistcom.apple.iChat.Jabber.plist
100
iChat Yahoo Plistcom.apple.iChat.Yahoo.plist
Loading...
 
 
 
[10.6] Snow Leopard
[10.7] Lion
[10.8] Mountain Lion
[10.9] Mavericks