Inside the Core Introduction

Episode Artwork
0% played 00:00 00:00
May 23 2009 6 mins  
Welcome to Inside the Core, the Macintosh & Apple Device Forensics podcast.

Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week.


The Mac OS X Forensics website

The Mac OS Forensics Yahoo Group

Tips & Tricks at the MacForensicLabs website

Plist of the Week

This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator.

To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image.