MacOS - Property List Files

Property list or ".plist" files can contain relevant data for forensicating on Apple computers and iOS devices.

In a kind of obscure similarity, like how windows stores configurations and setting in the windows registry.  Apple devices can store system and user settings in .plist files.  Can show a user's preferences and/or how he/she uses an application.

Several plist files are created when a system or application is first ran.  Aside from configuration info, plist files can provide information recent items and recently accessed files.

Some plists of potential interest include:
* (~) tilde means current logged in user user's folder.  (/Users/<username>)

• Recent Apps in the Apple Dock 

~/Library/Preferences/com.apple.dock.plist

• OS Version and Info

/System/Library/CoreServices/SystemVersion.plist 

• Last Logged-in user

/Library/Preferences/com.apple.loginwindow.plist

• Deleted Users

/Library/Preferences/com.apple.preferences.accounts.plist

• User Interaction with Apple Finder

~/Library/Preferences/com.apple.finder.plist

• Tracking volumes from the sidebarlist

~/Library/Preferences/com.apple.sidebarlists.plist

• Shared files list and recent items

/Users/<username>/Library/Application Support/com.apple.sharedfilelist/

• Recent Spotlight Searches

~/Library/Application Support/com.apple.spotlight.Shortcuts

• Installed Updates

/Library/Receipts/InstallHistory.plist

• List of User who can sign in

<VolumeUID>/System/Library/CoreServices/SystemVersion.plist

/<VolumeUID>/com.apple.installer/SystemVersion.plist

<VolumeUID>/System/Library/Caches/com.apple.corestorage/EncryptedRoot.plist.wipekey

• User Information

<VolumeUID>/var/db/CryptoUserInfo.plist