Friday, May 8, 2020

MacOS - Property List Files

Property list or ".plist" files can contain relevant data for forensicating on Apple computers and iOS devices.

In a kind of obscure similarity, like how windows stores configurations and setting in the windows registry.  Apple devices can store system and user settings in .plist files.  Can show a user's preferences and/or how he/she uses an application.

Several plist files are created when a system or application is first ran.  Aside from configuration info, plist files can provide information recent items and recently accessed files.

Some plists of potential interest include:
* (~) tilde means current logged in user user's folder.  (/Users/<username>)

  • Recent Apps in the Apple Dock 


  • OS Version and Info


  • Last Logged-in user


  • Deleted Users


  • User Interaction with Apple Finder


  • Tracking volumes from the sidebarlist

  • Shared files list and recent items
/Users/<username>/Library/Application Support/

  • Recent Spotlight Searches
~/Library/Application Support/

  • Installed Updates

  • List of User who can sign in



  • User Information

No comments:

Post a Comment