Artifacts

Stickies (Mac)

Posted by:  /  Tags: , , ,  /  Comments: 1

Author Name
Joe Garcia

Artifact Name
StickiesDatabase

Artifact/Program Version
Stickies on Mac OS X

Description
Stickies is a “sticky note” application that is installed by default on Mac OS X. This could be a potential source of information during a digital forensics examination. Think of the information that people leave on physical sticky notes around their desks and on their computers. Why should the digital ones be any different. You can use any Text Editor to parse the data included in this file. Once a new sticky is created or a previous one deleted, the StickiesDatabase file is immediately written to. There is no need for reboot for changes to take effect.









Directory/File Location
Macintosh HDD\Users\username\Library\StickiesDatabase

Forensic Programs of Use
TextEdit (Mac Text Editor)
OxED Hex Editor (Mac Application): http://www.suavetech.com/0xed/0xed.html

Other Info
Check out my SANS Forensics & Incident Response Blog post for more information:

One Comment

arrow

[…] This post was mentioned on Twitter by sansforensics, Joe Garcia, marknca, CyberCrime101, Forensic Artifacts and others. Forensic Artifacts said: Stickies (Mac) http://bit.ly/9vp2ME […]

Leave a Reply

Your Name: (required)

Your Email: (will not be published) (required)

Your Website:

Your Message:

submit comment