Artifacts

Archive for October, 2010


Stickies (Mac)

Posted by:  /  Tags: , , ,  /  Comments: 1

Author Name
Joe Garcia

Artifact Name
StickiesDatabase

Artifact/Program Version
Stickies on Mac OS X

Description
Stickies is a “sticky note” application that is installed by default on Mac OS X. This could be a potential source of information during a digital forensics examination. Think of the information that people leave on physical sticky notes around their desks and on their computers. Why should the digital ones be any different. You can use any Text Editor to parse the data included in this file. Once a new sticky is created or a previous one deleted, the StickiesDatabase file is immediately written to. There is no need for reboot for changes to take effect.









Directory/File Location
Macintosh HDD\Users\username\Library\StickiesDatabase

Forensic Programs of Use
TextEdit (Mac Text Editor)
OxED Hex Editor (Mac Application): http://www.suavetech.com/0xed/0xed.html

Other Info
Check out my SANS Forensics & Incident Response Blog post for more information: