May 23 2009 6 mins
Welcome to Inside the Core, the Macintosh & Apple Device Forensics podcast.
Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week.
Resources
The Mac OS X Forensics website
www.macosxforensics.com
The Mac OS Forensics Yahoo Group
tech.groups.yahoo/group/macos_forensics
Tips & Tricks at the MacForensicLabs website
www.macforensicslab.com
Plist of the Week
com.apple.preferences.account.plist
This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator.
To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image.
Today is a short introduction into what Inside the Core is all about. We will cover Mac specific resources and the Plist of the Week.
Resources
The Mac OS X Forensics website
www.macosxforensics.com
The Mac OS Forensics Yahoo Group
tech.groups.yahoo/group/macos_forensics
Tips & Tricks at the MacForensicLabs website
www.macforensicslab.com
Plist of the Week
com.apple.preferences.account.plist
This plist is located in the Local Library (/Library/Preferences) and holds information pertaining to deleted user accounts. These user accounts can be totally deleted from the system or archived by the administrator.
To see if the user accounts were archived, look in the Users folder for the Deleted Users subfolder (/Users/Deleted Users/). User accounts that have been archived will be in a disk image (DMG) format or if it was FileVaulted, a sparsebundle image.