Artifacts

Mac OS X Autorun Locations

Posted by:  /  Tags: , ,

Author Name
  pstirparo
Submission Title
  Mac OS X Autorun Locations
Post Category
  System
Submission Tags
  Apple, OSX, System
Artifact Description
  These artifacts refer to autorun programs and daemons that run at system startup.
File Locations
  Launch Agents files
– ‘/Library/LaunchAgents/*’
– ‘/System/Library/LaunchAgents/*’

Launch Daemons files
– ‘/Library/LaunchDaemons/*’
– ‘/System/Library/LaunchDaemons/*’

Startup Items file
– ‘/Library/StartupItems/*’
– ‘/System/Library/StartupItems/*’

Research Links
  https://github.com/pstirparo/mac4n6
http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location
https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=4
Any Other Information
  These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
– ForensicsWiki.org
– ForensicsArtifacts.com

So that the effort is made only once, and the output reused everywhere.

Leave a Reply

Your Name: (required)

Your Email: (will not be published) (required)

Your Website:

Your Message:

submit comment