Welcome to Inside the Core, the Macintosh & Apple Device Forensics podcast.
Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week.Resources
The Mac OS X Forensics websitewww.macosxforensics.com
The Mac OS Forensics Yahoo Grouptech.groups.yahoo/group/macos_forensics
Tips & Tricks at the MacForensicLabs websitewww.macforensicslab.comPlist of the Week
This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator.
To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image.