Sat, 23 May 2009
Welcome to Inside the Core, the Macintosh & Apple Device Forensics podcast.
Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week.
The Mac OS X Forensics website
The Mac OS Forensics Yahoo Group
Tips & Tricks at the MacForensicLabs website
Plist of the Week
This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator.
To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image.