Archive for September, 2010

Installed Printers (Mac)

Posted by:  /  Tags: , , , , ,

Author Name
Joe Garcia

Artifact Name
Installed Printers (Mac)

Artifact/Program Version
Mac OS X

This property list (plist) on a Mac OS X machine will tell you what types of printers have been installed on that system. Be advised though, that a printer may have been uninstalled/removed by the user and if they have not restarted their computer, that printer’s entry will persist until the computer is rebooted. This plist will then be overwritten to reflect the change.

Property List

File Locations

Research Links
Apple Developer Tools:

Forensic Programs of Use
plist Editor that is provided with XCode

State of the Artifacts: August

Posted by:  /  Comments: 1

First of all, thank you very much to all those that supported us through our launch this month. We greatly appreciate all the feedback and suggestions we have received.

While we are just starting out and have only posted twelve artifacts to date, we have received a great following and are looking forward to consistently adding content. Please consider sharing your expertise and submitting an artifact or two.

In the just under three weeks that the site has been active, we have received 5000 pageviews, have 82 RSS subscribers (according to Google Webmaster Tools), and have 79 followers on our Twitter feed.

The top five viewed artifacts this month were:

— Computer Name
— Skype
— App_Paths
— CurrentControlSet
— ShowHiddenFolders

The top five searches for artifacts (from both entry keyword and on-site searches) were:

— Google Desktop Search
— acmru
— plist
— prefetch

As the site is populated with more content these statistics will be much more interesting. For instance, there was some search activity for DLLs around the time the DLL exploit went wild. With additional content, we may be able to see search trends based on what malware is popular at the moment and what artifacts it might affect.

Hit submit and help the mission!

Thanks again to everyone who has helped with site and offered words of encouragement.