forensic-artifacts 20170808-1 / usr / share / artifacts / macos.yaml

# MacOS (Darwin) specific artifacts.

name: MacOSAppleSystemLogFiles
doc: Apple system log (ASL) files
sources:
- type: FILE
  attributes: {paths: ['/var/log/asl/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: MacOSApplications
doc: Applications
sources:
- type: DIRECTORY
  attributes: {paths: ['/Applications/*']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSApplicationsRecentItems
doc: Recent Items application specific
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/*LSSharedFileList.plist']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Recent_Items'
---
name: MacOSApplicationSupport
doc: Application Support Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/*']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: MacOSAtJobs
doc: MacOS at jobs
sources:
- type: FILE
  attributes: {paths: ['/usr/lib/cron/jobs/*']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
- 'https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/at.1.html#//apple_ref/doc/man/1/at'
---
name: MacOSAuditLogFiles
doc: Audit log files
sources:
- type: FILE
  attributes: {paths: ['/var/audit/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: MacOSBashHistory
doc: Terminal Commands History
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.bash_history']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: MacOSBluetoothPlistFile
doc: Bluetooth preferences and paired device information plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.Bluetooth.plist']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: MacOSCronTabs
doc: Cron tabs
sources:
- type: FILE
  attributes:
    paths:
      - '/etc/crontab'
      - '/usr/lib/cron/tabs/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
---
name: MacOSDock
doc: Dock database
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.Dock.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSGlobalPreferencesPlistFile
doc: Global Preferences plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/.GlobalPreferences.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: MacOSHostsFile
doc: Hosts file
sources:
- type: FILE
  attributes: {paths: ['/etc/hosts']}
labels: [System, Network]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Networking'
---
name: MacOSiCloudPreferences
doc: iCloud user preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/MobileMeAccounts.plist']}
labels: [Users, Cloud, ExternalAccount]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSiDevices
doc: Attached iDevices
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.iPod.plist']}
labels: [Users, External Media]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSInstallationHistory
doc: Software Installation History
sources:
- type: FILE
  attributes: {paths: ['/Library/Receipts/InstallHistory.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Software_Installation'
---
name: MacOSInstallationLogFile
doc: Installation log file
sources:
- type: FILE
  attributes: {paths: ['/var/log/install.log']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: MacOSiOSBackupInfo
doc: iOS device backup information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/info.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: MacOSiOSBackupManifest
doc: iOS device backup apps information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: MacOSiOSBackupMbdb
doc: iOS device backup files information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.mdbd']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: MacOSiOSBackupsMainDirectory
doc: iOS device backups directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: MacOSiOSBackupStatus
doc: iOS device backup status information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Status.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: MacOSKeychains
doc: Keychain Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Keychains/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: MacOSKeyboardLayoutPlistFile
doc: Keyboard layout plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.HIToolbox.plist']}
labels: [System]
supported_os: [Darwin]
---
name: MacOSKextFiles
doc: Kernel extension (.kext) files
sources:
- type: FILE
  attributes:
    paths:
      - '/System/Library/Extensions/*'
      - '/Library/Extensions/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Kernel_Extension'
---
name: MacOSLaunchAgentsPlistFiles
doc: Launch Agents plist files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/LaunchAgents/*'
      - '/System/Library/LaunchAgents/*'
      - '%%users.homedir%%/Library/LaunchAgents/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: MacOSLaunchDaemonsPlistFiles
doc: Launch Daemons plist files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/LaunchDaemons/*'
      - '/System/Library/LaunchDaemons/*'
      - '%%users.homedir%%/Library/LaunchDaemons/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: MacOSLoadedKexts
doc: MacOS Loaded Kernel Extensions.
sources:
- type: COMMAND
  attributes:
    args: []
    cmd: /usr/sbin/kextstat
labels: [System]
supported_os: [Darwin]
---
name: MacOSLocalTime
doc: Local time zone configuation
sources:
- type: FILE
  attributes:
    paths:
      - '/etc/localtime'
      - '/private/etc/localtime'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
---
name: MacOSLoginWindowPlistFile
doc: Log-in Window information plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.loginwindow.plist']}
labels: [System, Authentication]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: MacOSMailAccounts
doc: Mail Accounts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Accounts.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailBackupTOC
doc: Mail BackupTOC
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/BackupTOC.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailboxes
doc: Mail Mailbox Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/Mailboxes/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailDownloadAttachments
doc: Mail Downloads Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailEnvelopIndex
doc: Mail Envelope Index
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Envelope Index']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailIMAP
doc: Mail IMAP Synched Mailboxes
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/IMAP-*/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailMainDirectory
doc: Mail Main Folder
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailOpenedAttachments
doc: Mail Opened Attachments
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/OpenedAttachmentsV2.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailPOP
doc: Mail POP Synched Mailboxes
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/POP-*/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailPreferences
doc: Mail Preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.Mail.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailRecentContacts
doc: Mail Recent Contacts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/AddressBook/MailRecents-v4.abcdmr']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMailSignatures
doc: Mail Signatures by Account
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Signatures/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: MacOSMiscLogs
doc: Misc. Logs
sources:
- type: FILE
  attributes: {paths: ['/Library/Logs/*']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: MacOSMountedDMGs
doc: MacOS Mounted DMG files.
sources:
- type: COMMAND
  attributes:
    args: ['info']
    cmd: /usr/bin/hdiutil
labels: [System]
supported_os: [Darwin]
---
name: MacOSPeriodicSystemFunctions
doc: Periodic system functions scripts and configuration
sources:
- type: FILE
  attributes:
    paths:
      - '/etc/defaults/periodic.conf'
      - '/etc/periodic.conf'
      - '/etc/periodic.conf.local'
      - '/etc/periodic/**2'
      - '/usr/local/etc/periodic/**2'
      - '/etc/daily.local/*'
      - '/etc/weekly.local/*'
      - '/etc/monthly.local/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
- 'https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/periodic.8.html#//apple_ref/doc/man/8/periodic'
---
name: MacOSQuarantineEvents
doc: Quarantine Event Database
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEvents'
      - '%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2'
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSRecentItems
doc: Recent Items
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.recentitems.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Recent_Items'
---
name: MacOSSidebarLists
doc: |
  Sidebar Lists Preferences

  This plist contains the names of volumes mounted on the desktop that have appeared in the sidebar list.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.sidebarlists.plist']}
labels: [Users, External Media]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSSkypechatsync
doc: Chat Sync Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/chatsync/*']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: MacOSSkypeDb
doc: Main Skype database
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/Main.db']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: MacOSSkypePreferences
doc: Skype Preferences and Recent Searches
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.skype.skype.plist']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: MacOSSkypeUserProfile
doc: Skype User profile
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/*']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: MacOSSleepimageFile
doc: Sleepimage file which contains the content of memory before going to sleep
sources:
- type: FILE
  attributes:
    paths:
    - '/private/var/vm/sleepimage'
    - '/var/vm/sleepimage'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Sleep.2FHibernate_and_Swap_Image_File'
---
name: MacOSStartupItemsPlistFiles
doc: Startup Items plist files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/StartupItems/*'
      - '/System/Library/StartupItems/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: MacOSSwapFiles
doc: Swap files
sources:
- type: FILE
  attributes: {paths: ['/var/vm/swapfile#']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Sleep.2FHibernate_and_Swap_Image_File'
---
name: MacOSSystemConfigurationPreferencesPlistFile
doc: System configuration preferences plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/SystemConfiguration/preferences.plist']}
labels: [System]
supported_os: [Darwin]
---
name: MacOSSystemInstallationTime
doc: System installation time
sources:
- type: FILE
  attributes: {paths: ['/var/db/.AppleSetupDone']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: MacOSSystemLogFiles
doc: System log files
sources:
- type: FILE
  attributes: {paths: ['/var/log/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: MacOSSystemPreferencesPlistFiles
doc: System Preferences plist files
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/**']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: MacOSSystemVersionPlistFile
doc: Operating system name and version plist file
sources:
- type: FILE
  attributes: {paths: ['/System/Library/CoreServices/SystemVersion.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: MacOSUpdate
doc: Software Update
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.SoftwareUpdate.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Software_Installation'
---
name: MacOSUserApplicationLogs
doc: User and Applications Logs Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Logs/*']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: MacOSUserDesktopDirectory
doc: Desktop Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Desktop/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserDocumentsDirectory
doc: Documents Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Documents/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserDownloadsDirectory
doc: User downloads directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Downloads/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserGlobalPreferences
doc: User Global Preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/.GlobalPreferences.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSUserLibraryDirectory
doc: Library Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Library/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserLoginItems
doc: Login Items
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.loginitems.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations_2'
---
name: MacOSUserMoviesDirectory
doc: Movies Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Movies/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserMusicDirectory
doc: Music Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Music/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserPasswordHashesPlistFiles
doc: User password hashes plist files
sources:
- type: FILE
  attributes:
    paths:
      - '/var/db/dslocal/nodes/Default/users/*.plist'
      - '/private/var/db/dslocal/nodes/Default/users/*.plist'
labels: [System, Users, Authentication]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: MacOSUserPicturesDirectory
doc: Pictures Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Pictures/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUserPreferences
doc: User preferences directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: MacOSUserPublicDirectory
doc: Public Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Public/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: MacOSUsers
doc: Users directories in /Users
sources:
- type: DIRECTORY
  attributes: {paths: ['/Users/*']}
labels: [Users]
supported_os: [Darwin]
provides: [users.username]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Users'
---
name: MacOSUserSocialAccounts
doc: User's Social Accounts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Accounts/Accounts3.sqlite']}
labels: [Users, ExternalAccount]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User.27s_Accounts'
---
name: MacOSTimeMachinePlistFile
doc: Time Machine information plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.TimeMachine.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: MacOSUserTrash
doc: User Trash Folder
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.Trash/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: MacOSWirelessNetworks
doc: Remembered Wireless Networks
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist']}
labels: [System, Network]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Networking'