Artifacts

Posts Tagged ‘plist’


Mac OS X User Preference Settings

Posted by:  /  Tags: , , ,

Author Name
Pasquale Stirparo, @pstirparo
Submission Title
Mac OS X User Preference Settings
Artifact Description
Num. 1 is the directory containing user preference settings for applications and utilities


Num. 3 is the plists containing the names of volumes mounted on the desktop that have appeared in the sidebar list


Num. 4 is Global Preferences Plist


Num. 5 contains directories, files, and apps that have appeared in the Dock


Num 6 contains the list of attached iDevices


Num 7 is the SQLite database that keeps track of files that have the quarantine extended attribute that is given to applications, scripts, and executables downloaded from potentially untrustworthy locations/people. The SQLite database contains URLS, email addresses, email subjects, and other potentially useful information.
File Locations
1) User preferences directory
– %%users.homedir%%/Library/Preferences/*


2) iCloud user preferences
– %%users.homedir%%/Library/Preferences/MobileMeAccounts.plist


3) Sidebar Lists Preferences
– %%users.homedir%%/Preferences/com.apple.sidebarlists.plist


4) Global Preferences
– %%users.homedir%%/Library/Preferences/.GlobalPreferences.plist


5) Dock database
– %%users.homedir%%/Library/Preferences/com.apple.Dock.plist


6) Attached iDevices
– %%users.homedir%%/Library/Preferences/com.apple.iPod.plist


7) Quarantine Event Database
– %%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
– %%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
Research Links
https://github.com/pstirparo/mac4n6


http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location


https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=4
Any Other Information
These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
– ForensicsWiki.org
– ForensicsArtifacts.com
So that the effort is made only once, and the output reused everywhere.

 

Mac OS X: iOS device backup locations

Posted by:  /  Tags: , , , , ,

Author Name
Pasquale Stirparo, @pstirparo
Submission Title
Mac OS X: iOS device backup locations
Artifact Description
Num. 1 is the main directory inside a Mac containing iOS device backups


Num. 2 is a plist file in plain text. It stores data about the backed up device (such as device name, GUID, ICCID, IMEI, Product type, iOS version, serial numbers, UDID etc.) and the iTunes software used to create the backup (iTunes version number, iTunes settings).


Num. 3 is a plist file in plain text and it describes the content of the backup. Inside this file we can find the list of applications installed on the backed up device. For every application there are the name and the particular version. Inside the file there is also the date the backup was made, the backup type (encrypted vs. unencrypted) and some information about the iDevice and the iTunes software used.


Num. 4 is a binary file that stores the descriptions of all the other files in the backup directory. It contains a record for each element in the backup.


Num. 5 It’s a plist file in binary format and it stores information about the completion of the backup
File Locations
1) iOS device backups directory
– %%users.homedir%%/Library/Application Support/MobileSync/Backup/*


2) iOS device backup information
– %%users.homedir%%/Library/Application Support/MobileSync/Backup/*/info.plist


3) iOS device backup apps information
– %%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.plist


4) iOS device backup files information
– %%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.mdbd


5) iOS device backup status information
– %%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Status.plist
Research Links
https://github.com/pstirparo/mac4n6


http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location


https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=4
Any Other Information
These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
– ForensicsWiki.org
– ForensicsArtifacts.com
So that the effort is made only once, and the output reused everywhere.

 

Mac OS X “Recent Items”

Posted by:  /  Tags: , , ,

Author Name
Pasquale Stirparo, @pstirparo
Submission Title
Mac OS X “Recent Items”
Artifact Description
Num. 1 contains info about the recently opened applications, files, and servers


Num. 2 contains info about the recently opened files specific for each application
File Locations
1) Recent Items
– %%users.homedir%%/Library/Preferences/com.apple.recentitems.plist


2) Recent Items application specific
– %%users.homedir%%/Library/Preferences/*LSSharedFileList.plist
Research Links
https://github.com/pstirparo/mac4n6


http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location


https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=4
Any Other Information
These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
– ForensicsWiki.org
– ForensicsArtifacts.com
So that the effort is made only once, and the output reused everywhere.

 

System Version (Mac)

Posted by:  /  Tags: , , , , , ,

Author Name
Douglas Brush

Artifact Name
SystemVersion.plist

Artifact/Program Version
OS X 10.x (Client)

Description
When you start your Macintosh investigation it is important to know
what version of the operating system is installed on the computer. The
version of OS X (10.4, 10.5, 10.6) can shape and direct the analysis
as each version has certain unique characteristics for other artifacts
as well as their locations on the disk.

Macintosh operating systems use plist files (.plist) as repositories
for system and program settings/information. Plist files can wither be
in a binary-encoded format (bplist file header) or as XML.

To get the operating system version the first plist files you will
want to examine is the “SystemVersion.plist” located in
“/System/Library/CoreServices/” folder. With this knowledge you
can be aware of other plists and system artifacts that are unique to
the OS under inspection.

File Locations
/System/Library/CoreServices/SystemVersion.plist

Research Links

Forensic Programs of Use
plist Edit Pro (Mac):

plist Editor Pro (Win):

Installed Printers (Mac)

Posted by:  /  Tags: , , , , ,

Author Name
Joe Garcia

Artifact Name
Installed Printers (Mac)

Artifact/Program Version
Mac OS X

Description
This property list (plist) on a Mac OS X machine will tell you what types of printers have been installed on that system. Be advised though, that a printer may have been uninstalled/removed by the user and if they have not restarted their computer, that printer’s entry will persist until the computer is rebooted. This plist will then be overwritten to reflect the change.





Property List
org.cups.printers.plist

File Locations
HDD/Library/Preferences

Research Links
Apple Developer Tools: http://developer.apple.com/technologies/tools/xcode.html

Forensic Programs of Use
plist Editor that is provided with XCode

Safari Browsing History (Mac)

Posted by:  /  Tags: , , , , , , ,  /  Comments: 2

Author Name

Joe Garcia

Artifact Name

Safari Browsing History (Mac)

Description

Safari is the default browser on the Mac OS X Operating System.  As with most browsers, there is a plethora of information to be found and Browsing History is one of them.  If you are looking into the Safari Browsing History on an Apple computer, you will have to find the History.plist to get that information.  For those that don’t know, a plist is a Preference file for an application on an Apple computer.  They usually contain user settings for that particular application.  They also hold information regarding that application.  The default setting for Browsing History in Safari 4 and 5 is one month.

Now, locate the Safari History plist by navigating to /username/Library/Safari/History.plist on the suspect machine.  Then export it out of your case.  If you are working in a Windows based forensics lab, you can download a copy of WOWSoft’s free plist Editor and install it.  Once installed, find the exported copy of the History.plist file and open it.  You will see the following screen:


If you are using a Mac as your forensics platform, I would suggest heading over to the Apple Developers site and register there to get a free copy of XCode 3.  XCode comes with a plist Editor included.  Once installed, it becomes your default viewer for plists.  Locate the History.plist file that you wish to view and double click on it.  It will open in the plist Editor and here is what you will see:



Now let’s say I want to find out the Last Visit Date & Time to a particular site.  I would locate the site in the History and look for the lastVisitedDate row and look across to the right to the third column:

In the XCode plist Editor:


In the WOWSoft plist Editor:


Now the value that you see recorded there is Mac Absolute Time. You are going to want to decode that into a readable format. In Windows, you can download a copy of R. Craig Wilson’s DCode to do that. For example, you would take the number shown in the lastVisitedDate row and enter all of the numbers in up to the period into DCode, choose Mac Absolute Time and make sure to adjust for the suspect machine’s Time Zone Settings and click on Decode. I have used the lastVisitedDate string from the example screenshots I have provided above and received the following results:



AUTHOR NOTE— As of this post, I am unfamiliar with a tool/utility that works in Mac OS X that has the same functionality. If someone can point me in the right direction, I will be more than happy to edit this post and give full credit.

File Location

/username/Library/Safari/History.plist

Forensic Tools of Use

Apple Developer Tools (XCode): http://developer.apple.com/programs/mac/

WOWSoft’s Free plist editor of Windows: http://www.icopybot.com/blog/free-plist-editor-for-windows-10-released.htm

DCode by R. Craig Wilson (Digital Detective UK): http://www.digital-detective.co.uk/freetools/decode.asp