Sat, 23 May 2009
Welcome to Inside the Core, the Macintosh & Apple Device Forensics podcast.
Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week. Resources The Mac OS X Forensics website www.macosxforensics.com The Mac OS Forensics Yahoo Group tech.groups.yahoo/group/macos_forensics Tips & Tricks at the MacForensicLabs website www.macforensicslab.com Plist of the Week com.apple.preferences.account.plist This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator. To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image. |