forensic-artifacts 20161022-1 / usr / share / artifacts / darwin.yaml

# Mac OS X (Darwin) specific artifacts.

name: OSXLaunchAgents
doc: Launch Agents files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/LaunchAgents/*'
      - '/System/Library/LaunchAgents/*'
      - '%%users.homedir%%/Library/LaunchAgents/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: OSXLaunchDaemons
doc: Launch Daemons files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/LaunchDaemons/*'
      - '/System/Library/LaunchDaemons/*'
      - '%%users.homedir%%/Library/LaunchDaemons/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: OSXStartupItems
doc: Startup Items files
sources:
- type: FILE
  attributes:
    paths:
      - '/Library/StartupItems/*'
      - '/System/Library/StartupItems/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations'
---
name: OSXSystemLogs
doc: System Log files main folder
sources:
- type: FILE
  attributes: {paths: ['/var/log/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: OSXAppleSystemLogs
doc: Apple System Log
sources:
- type: FILE
  attributes: {paths: ['/var/log/asl/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: OSXAuditLogs
doc: Audit Log
sources:
- type: FILE
  attributes: {paths: ['/var/audit/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: OSXInstallationLog
doc: Installation log
sources:
- type: FILE
  attributes: {paths: ['/var/log/install.log']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
---
name: OSXSystemPreferences
doc: System Preferences files
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/**']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: OSXGlobalPreferences
doc: Global Preferences
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/.GlobalPreferences.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: OSXLoginWindow
doc: Login Window Info
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.loginwindow.plist']}
labels: [System, Authentication]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: OSXBluetooth
doc: Bluetooth preferences and paired device info
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.Bluetooth.plist']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: OSXTimeMachine
doc: Time Machine Info
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.TimeMachine.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Preferences'
---
name: OSXInstallationTime
doc: OS Installation time
sources:
- type: FILE
  attributes: {paths: ['/var/db/.AppleSetupDone']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: OSXSystemVersion
doc: OS name and version
sources:
- type: FILE
  attributes: {paths: ['/System/Library/CoreServices/SystemVersion.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: OSXPasswordHashes
doc: Users Log In Password Hash Plist
sources:
- type: FILE
  attributes: {paths: ['/var/db/dslocal/nodes/Default/users/*']}
labels: [System, Users, Authentication]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Settings_and_Informations'
---
name: OSXSleepimage
doc: Sleep Image File
sources:
- type: FILE
  attributes: {paths: ['/var/vm/sleepimage']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Sleep.2FHibernate_and_Swap_Image_File'
---
name: OSXSwapfiles
doc: Swap Files
sources:
- type: FILE
  attributes: {paths: ['/var/vm/swapfile#']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Sleep.2FHibernate_and_Swap_Image_File'
---
name: OSXKexts
doc: Kernel extensions
sources:
- type: FILE
  attributes:
    paths:
      - '/System/Library/Extensions/*'
      - '/Library/Extensions/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Kernel_Extension'
---
name: OSXInstallationHistory
doc: Software Installation History
sources:
- type: FILE
  attributes: {paths: ['/Library/Receipts/InstallHistory.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Software_Installation'
---
name: OSXUpdate
doc: Software Update
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.SoftwareUpdate.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Software_Installation'
---
name: OSXLocalTime
doc: Current Time Zone
sources:
- type: FILE
  attributes: {paths: ['/etc/localtime']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
---
name: OSXAtJobs
doc: Mac OS X at jobs
sources:
- type: FILE
  attributes: {paths: ['/usr/lib/cron/jobs/*']}
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
- 'https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/at.1.html#//apple_ref/doc/man/1/at'
---
name: OSXCronTabs
doc: Cron tabs
sources:
- type: FILE
  attributes:
    paths:
      - '/etc/crontab'
      - '/usr/lib/cron/tabs/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
---
name: OSXPeriodicSystemFunctions
doc: Periodic system functions scripts and configuration
sources:
- type: FILE
  attributes:
    paths:
      - '/etc/defaults/periodic.conf'
      - '/etc/periodic.conf'
      - '/etc/periodic.conf.local'
      - '/etc/periodic/**2'
      - '/usr/local/etc/periodic/**2'
      - '/etc/daily.local/*'
      - '/etc/weekly.local/*'
      - '/etc/monthly.local/*'
labels: [System]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Info_Misc.'
- 'https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/periodic.8.html#//apple_ref/doc/man/8/periodic'
---
name: OSXHostsFile
doc: Hosts file
sources:
- type: FILE
  attributes: {paths: ['/etc/hosts']}
labels: [System, Network]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Networking'
---
name: OSXWirelessNetworks
doc: Remembered Wireless Networks
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist']}
labels: [System, Network]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Networking'
---
name: OSXUserLoginItems
doc: Login Items
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.loginitems.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Autorun_Locations_2'
---
name: OSXUsers
doc: Users directories in /Users
sources:
- type: DIRECTORY
  attributes: {paths: ['/Users/*']}
labels: [Users]
supported_os: [Darwin]
provides: [users.username]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Users'
---
name: OSXUserDownloadsDirectory
doc: User downloads directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Downloads/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserDocumentsDirectory
doc: Documents Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Documents/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserMusicDirectory
doc: Music Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Music/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserDesktopDirectory
doc: Desktop Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Desktop/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserLibraryDirectory
doc: Library Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Library/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserMoviesDirectory
doc: Movies Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Movies/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserPicturesDirectory
doc: Pictures Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Pictures/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserPublicDirectory
doc: Public Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Public/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXApplications
doc: Applications
sources:
- type: DIRECTORY
  attributes: {paths: ['/Applications/*']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User_Directories'
---
name: OSXUserPreferences
doc: User preferences directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXiCloudPreferences
doc: iCloud user preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/MobileMeAccounts.plist']}
labels: [Users, Cloud, ExternalAccount]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXSidebarLists
doc: |
  Sidebar Lists Preferences

  This plist contains the names of volumes mounted on the desktop that have appeared in the sidebar list.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.sidebarlists.plist']}
labels: [Users, External Media]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXUserGlobalPreferences
doc: User Global Preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/.GlobalPreferences.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXDock
doc: Dock database
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.Dock.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXiDevices
doc: Attached iDevices
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.iPod.plist']}
labels: [Users, External Media]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXQuarantineEvents
doc: Quarantine Event Database
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEvents'
      - '%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2'
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Preferences'
---
name: OSXUserApplicationLogs
doc: User and Applications Logs Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Logs/*']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: OSXMiscLogs
doc: Misc. Logs
sources:
- type: FILE
  attributes: {paths: ['/Library/Logs/*']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: OSXBashHistory
doc: Terminal Commands History
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.bash_history']}
labels: [Users, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Logs'
---
name: OSXUserSocialAccounts
doc: User's Social Accounts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Accounts/Accounts3.sqlite']}
labels: [Users, ExternalAccount]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#User.27s_Accounts'
---
name: OSXiOSBackupsMainDirectory
doc: iOS device backups directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: OSXiOSBackupInfo
doc: iOS device backup information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/info.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: OSXiOSBackupManifest
doc: iOS device backup apps information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: OSXiOSBackupMbdb
doc: iOS device backup files information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Manifest.mdbd']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: OSXiOSBackupStatus
doc: iOS device backup status information
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/MobileSync/Backup/*/Status.plist']}
labels: [Users, iOS]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iDevice_Backup'
---
name: OSXRecentItems
doc: Recent Items
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.recentitems.plist']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Recent_Items'
---
name: OSXApplicationsRecentItems
doc: Recent Items application specific
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/*LSSharedFileList.plist']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Recent_Items'
---
name: OSXApplicationSupport
doc: Application Support Directory
sources:
- type: DIRECTORY
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/*']}
labels: [Users, Software]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: OSXKeychains
doc: Keychain Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Keychains/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: OSXUserTrash
doc: User Trash Folder
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.Trash/*']}
labels: [Users]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Misc.'
---
name: OSXiCloudAccounts
doc: iCloud Accounts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/iCloud/Accounts/*']}
labels: [Users, Software, Cloud, ExternalAccount]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#iCloud'
---
name: OSXSkypeUserProfile
doc: Skype User profile
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/*']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: OSXSkypePreferences
doc: Skype Preferences and Recent Searches
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.skype.skype.plist']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: OSXSkypeDb
doc: Main Skype database
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/Main.db']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: OSXSkypechatsync
doc: Chat Sync Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*/chatsync/*']}
labels: [Users, Software, IM]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
---
name: OSXMailMainDirectory
doc: Mail Main Folder
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailboxes
doc: Mail Mailbox Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/Mailboxes/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailIMAP
doc: Mail IMAP Synched Mailboxes
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/IMAP-*/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailPOP
doc: Mail POP Synched Mailboxes
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/POP-*/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailBackupTOC
doc: Mail BackupTOC
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/BackupTOC.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSCMailEnvelopIndex
doc: Mail Envelope Index
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Envelope Index']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailOpenedAttachments
doc: Mail Opened Attachments
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/OpenedAttachmentsV2.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailSignatures
doc: Mail Signatures by Account
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Signatures/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailDownloadAttachments
doc: Mail Downloads Directory
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/*']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailPrefs
doc: Mail Preferences
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Preferences/com.apple.Mail.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailRecentContacts
doc: Mail Recent Contacts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Application Support/AddressBook/MailRecents-v4.abcdmr']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXMailAccounts
doc: Mail Accounts
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Accounts.plist']}
labels: [Users, Software, Mail]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Mail'
---
name: OSXLoadedKexts
doc: Mac OS X Loaded Kernel Extensions.
sources:
- type: COMMAND
  attributes:
    args: []
    cmd: /usr/sbin/kextstat
labels: [System]
supported_os: [Darwin]
---
name: OSXMountedDMGs
doc: Mac OS X Mounted DMG Files.
sources:
- type: COMMAND
  attributes:
    args: ['info']
    cmd: /usr/bin/hdiutil
labels: [System]
supported_os: [Darwin]