OS X Lion Artifacts v1.0

7/31/2019 OS X Lion Artifacts v1.0

1/39

OS X Lion Artifacts By: Sean Cavanaugh

Last Modified: 12/19/2011 - added some links to helpful articles

Artifact

User Directories

Downloads DirectoryDocuments Directory

Music Directory

Desktop Directory

Library Directory

Movies Directory

Pictures Directory

Public Directory

Sites Directory

Applications

Applications

Safari

Safari Bookmarks

Safari Downloads

Safari Installed Extensions

Safari Extensions

Safari History

Safari History Index

Safari Last Session

Safari Local Storage Directory

Safari Local Storage Database

Safari Saved Desktop Image

Safari Top Sites

Safari Webpage Icons Database

Safari Webpage Databases

Safari Webpage Databases Database

Safari Cache Directory

Safari Cache

Safari Extensions Cache

Safari Webpage Previews

Safari Cookies

Safari Preferences

Safari Saved Application State Directory

Safari Bookmark Cache

Safari History Cache

Mail

Mail Cache

Mail Mailbox Directory

Mail IMAP Synched Mailboxes

Mail POP Synched Mailboxes


2/39

Mail BackupTOC

Mail Envelope Index

Mail Opened Attachments

Mail Search History

Mail Signatures by Account

Mail Smart Mailbox Info

Mail RSS Feeds

Mail Downloads Directory

Mail Preferences

Mail Recent Contacts

iChat

iChat Preferences

Saved Chats

Icon

Recent Pictures

iChat AIM Plist

iChat Jabber PlistiChat Yahoo Plist

iChat Status Messages Plist

iChat PubSub Plist

iPhoto

iPhoto Library

Original Photos

Modified Photos

iPhoto Main Database

iDevice Photo Cache

Face Recognition ArtifactsAlbum Data

Album Data 2

iPhoto Spotlight File

iPhoto Recent Items

iPhoto Preferences

iPhoto Trash - See Apple Examiner paper

iTunes

iTunes Preferences

iTunes Library Directory

iTunes MediaiTunes Library Structure

Photo Booth

Recent Pictures

Photo Booth Pictures Directory

Cache


3/39

Photo Booth Preferences

Address Book

Address Book Database

Address Book Last Configuration Fetch

Address Book Preferences

Spotlight

Spotlight Directory

Shutdown Time

RSS

RSS Feeds Database

RSS Feed Plist

Feeds Directory

Mail RSS Mailbox Directory

Saved Application State

Saved Application State Directory

Saved Application Window Plist

Preferences

Preferences Directory

Global Preferences

Photo Booth Preferences

Microsoft Office Preferences and Recent ItemsCalculator Preferences

Dashboard Preferences

Desktop Preferences

Disk Utility Preferences

Dock Preferences

Finder Preferences

iCal Preferences

iChat Preferences

iMovie Preferences

iPhoto Preferences

iWeb Preferences

iTunes PreferencesOnyX Preferences

KisMAC Preferences

Black Hole System Cleaner Preferences

AOL Instant Messenger Preferences

Keychain Preferences

Address Book Preferences

iApps Database Preferences


4/39

Sidebar Lists Preferences

Autorun Locations

Login Window

Login Items

Library Launch Agents

Library Launch Daemons

Library Startup Items

System Launch Daemons

System Startup Items

Recent Items

Preview Recent Items

Property List Editor Recent Items

QuickTime Recent Items

Recent Items

Screen Sharing Recent SharesTextEdit Recent Items

VLC Video Player Recent Items

Grab Screen Shot Recent Items

Console Recent Items

Misc.

Logs Directory

Misc. Logs

Misc. Logs

Dock database

Attached iDevicesLaunch Service Quarantine Events

Terminal Commands History

Owner Information Plist

Application Support Directory

Keychain Directory

Trash

OS Version Plist

User Setup Plist

Mobile Backups Directory

Flash Shared Objects

Flash Player Support

CD Information DatabaseLogin Window Info

Bluetooth Preferences

Software Update

Time Machine Info

Remembered Wireless Networks

Document Revisions Directory

Sleep Image File


5/39

Swap Files

User Log In Password Hash Plist

Firefox

Firefox DirectoryFirefox Profiles

Firefox Cookies

Firefox Downloads

Firefox Form History

Firefox History

Google Chrome

Chrome Directory

Chrome Cache

Preference Files

Chrome Helper FileChrome Update Plist

Tor

Hidden Tor Directory

State File

VirtualBox

VirtuaBox Directory

VirtualBox Settings

VirtualBox Log FileVirtualBox Cache Directory

VirtualBox VM Directory

Drop Box

Shared Folder

Drop Box Cache Folder

Drop Box Config Folder

Drop Box Config Database

Drop Box File Cache

Skype

Skype Directory

User profile

Skype Preferences and Recent Searches

Main Skype database

Chat Sync Directory


6/39

Handbrake DVD Ripper

Handbrake Directory

Logs

Activity Log

Queue

Previews Directory

Preferences & Last Launch

Networking

Hosts file

Remembered Wireless Networks

Twitter

Twitter Preferences

Application

Twitter Cache DirectoryTwitter cache file

Twitter Saved Application State Directory

iCloud

iCloud Accounts

Adium Chat Client

Chat Transcripts

CleanMyMac

Preferences and Settings

Evernote

Evernote Application Support Directory

Evernote Data/Profile Directory

Evernote Logs

Evernote Profile Info

Evernote User Content

Network Time Protocol (NTP) Validation Logs

Hostconfig FIle

NTP Config File

NTP Drift File

Sleep State Logs


7/39

Directory Service Server Log

Apple System Log


8/39

[email protected]

Twitter: @spcavanaugh

Name

DownloadsDocuments

Music

Desktop

Library

Movies

Pictures

Public

Sites

Applications

Applications

Bookmarks.plist

Downloads.plist

Extensions.plist

Extensions

History.plist

HistoryIndex.sk

LastSession.plist

LocalStorage

StorageTracker.db

Safari Desktop Picture.jpg

TopSites.plist

WebpageIcons.db

Databases

Databases.db

com.apple.Safari

Cache.db

Extensions

Webpage Previews

Cookies.plist

com.apple.Safari.plist

com.apple.Safari.savedState

Bookmarks

History

Cache.db

Mailboxes

IMAP-

POP-


9/39

BackupTOC.plist

Envelop Index

OpenedAttachments.plist

SearchHistory.plist

SignaturesByAccount.plist

SmartMailboxes.plist

RSS

Mail Downloads

com.apple.Mail.plist

MailRecents-v4.abcdmr

com.apple.iChat.plist

iChats

Pictures

iChat Recent Pictures

com.apple.iChat.AIM.plist

com.apple.iChat.Jabber.plistcom.apple.iChat.Yahoo.plist

com.apple.iChat.StatusMessages.plist

com.apple.iChat.PubSub.plist

iPhoto Library

Originals

Modified

iPhotoMain.db

iPod Photo Cache

face.db, face_blob.dbAlbumData.xml

AlbumData2.xml

iPhoto.ipspot

com.apple.iPhoto.LSSharedFileList.plist

com.apple.iPhoto.plist

http://www.appleexaminer.com/files/iPhoto_Trash_Analysis.pdf

com.apple.iTunes.plist

iTunes

iTunes MediaiTunes Music Library.xml

Recents.plist

Pictures

com.apple.PhotoBooth


10/39

com.apple.PhotoBooth.plist

AddressBook-v22.abcddb

com.apple.AddressBook.abd.plist

com.apple.AddressBook.plist

.Spotlight-V100

shutdown_time

Database.sqlite3

Clients.plist

Feeds

RSS

Saved Application State

Windows.plist

Preferences

.GlobalPreferences.plist

com.apple.PhotoBooth.plist

com.microsoft.office.plistcom.apple.Calculator.plist

com.apple.Dashboard.plist

com.apple.Desktop.plist

com.apple.DiskUtility.plist

com.apple.Dock.plist

com.apple.Finder.plist

com.apple.iCal.plist

com.apple.iChat.plist

com.apple.iMovie8.plist

com.apple.iPhoto.plist

com.apple.iWeb.plist

com.apple.iTunes.plistcom.apple.OnyX.plist

org.kismac-ng.kismac.plist

net.irradiated.Black-Hole.plist

com.aol.aim.desktop.plist

com.apple.keychainaccess.plist

com.apple.AddressBook.plist

com.apple.iApps.plist


11/39

com.apple.sidebarlists.plist

loginwindow.plist

com.apple.LoginItems.plist

LaunchAgents

LaunchDaemons

StartupItems

LaunchDaemons

StartupItems

com.apple.Preview.LSSharedFileList.plist

com.apple.PropertyListEditor.LSSharedFileList.plist

com.apple.QuickTimePlayerX.LSSharedFileList.plist

com.apple.RecentItems.plist

com.apple.ScreenSharing.LSSharedFileList.plistcom.apple.TextEdit.LSSharedFileList.plist

org.videolan.vlc.LSSharedFileList.plist

com.apple.Grab.LSSharedFileList.plist

com.apple.Console.LSSharedFileList.plist

Logs

log

Logs

com.apple.Dock.db

com.apple.iPod.plistcom.apple.LaunchServices.QuarantineEvents

.bash_history

AddressBookMe.plist

Application Support

Keychains

.Trash

SystemVersion;plist

.AppleSetupDone

MobileBackups

#SharedObjects

sys

CD Info.cidbcom.apple.loginwindow.plist

com.apple.Bluetooth.plist

com.apple.SoftwareUpdate.plist

com.apple.TimeMachine.plist

com.apple.airport.preferences.plist

.DocumentRevisions-V100

sleepimage


12/39

swapfile#

.plist

FirefoxProfiles

Cookies.sqlite

Downloads.sqlite

Formhistory.sqlite

Places.sqlite

Chrome

com.google.chrome

com.google.Chrome.plist

com.google.Chrome.helper.plstcom.google.Keystone.Agent.plist

.tor

State

VirtualBox

VirtualBox.xml

VBoxSVC.logorg.virtualbox.app.VirtualBox

VirtualBox VMs

Dropbox

com.getdropbox.dropbox

.dropbox

Config.db

filecache.db

Skype

com.skype.skype.plist

Main.db

chatsync


13/39

Handbrake

EncodeLogs

HandBrake-activtylog.txt

Queue.plist

Previews

org.m0k.handbrake.plist

hosts

com.apple.airport.preferences.plist

com.twitter.twitter-mac.plist

Twitter

com.twitter.twitter-macCache.db

com.twitter.twitter-mac.savedState

Accounts

Logs

com.macpaw.CleanMyMac.plist

Evernote

data

logs

Evernote.sql

Content

hostconfig

ntp.conf

ntp.drift


14/39

DirectoryService.server.log

asl.log


15/39

Want to add to the list? Email artifact info to [email protected]

http://tinyurl.com/63l2l6k

Path

/Users//Downloads//Users//Documents/

/Users//Music/

/Users//Desktop/

/Users//Library/

/Users//Movies/

/Users//Pictures/

/Users//Public/

/Users//Sites/

/Users//Applications/

/Applications/

/Users//Library/Safari/Bookmarks.plist

/Users//Library/Safari/Downloads.plist

/Users//Library/Safari/Extensions/Extensions.plist

/Users//Library/Safari/Extensions/

/Users//Library/Safari/History.plist

/Users//Library/Safari/HistoryIndex.sk

/Users//Library/Safari/LastSession.plist

/Users//Library/Safari/LocalStorage/

/Users//Library/Safari/LocalStorage/StorageTracker.db

/Users//Library/Safari/Saved Desktop Picture.jpg

/Users//Library/Safari/TopSites.plist

/Users//Library/Safari/WebpageIcons.db

/Users//Library/Safari/Databases/

/Users//Library/Safari/Databases/Databases.db

/Users//Library/Caches/com.apple.Safari/

/Users//Library/Caches/com.apple.Safari/Cache.db

/Users//Library/Caches/com.apple.Safari/Extensions/

/Users//Library/Caches/com.apple.Safari/Webpage Previews/

/Users//Library/Cookies/Cookies.plist

/Users//Library/Preferences/com.apple.Safari.plist

/Users//Library/Saved Application State/com.apple.Safari.savedState/

/Users//Library/Caches/Metadata/Safari/Bookmarks/

/Users//Library/Caches/Metadata/Safari/History/

/Users//Library/Caches/com.apple.Mail/Cache.db

/Users//Library/Mail/V2/Mailboxes/

/Users//Library/Mail/V2/IMAP-

/Users//Library/Mail/V2/POP-


16/39

/Users//Library/Mail/V2/MailData/BackupTOC.plist

/Users//Library/Mail/V2/MailData/Envelope Index

/Users//Library/Mail/V2/MailData/OpenedAttachments.plist

/Users//Library/Mail/V2/MailData/SearchHistory.plist

/Users//Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plist

/Users//Library/Mail/V2/MailData/SmartMailboxes.plist

/Users//Library/Mail/V2/RSS/

/Users//Library/Mail Downloads/

/Users//Library/Preferences/com.apple.Mail.plist

/Users//Library/Application Support/Address Book/MailRecents-v4.abcdmr

/Users//Library/Preferences/com.apple.iChat.plist

/Users//Documents/iChats/

/Users//Library/Caches/com.apple.iChat/Pictures

/Users//Library/Images/iChat Recent Pictures/

/Users//Pictures/iPhoto Library

/Users//Pictures/iPhoto /Library/Originals/

/Users//Pictures/iPhoto /Library/Modified/

/Users//Pictures/iPhoto /Library/iPhotoMain.db

/Users//Pictures/iPhoto /Library/iPod Photo Cache/

/Users//Pictures/iPhoto /Library//Users//Pictures/iPhoto /Library/AlbumData.xml

/Users//Pictures/iPhoto /Library/AlbumData2.xml

/Users//Pictures/iPhoto /Library/iPhoto.ipspot

/Users//Library/Preferences/com.apple.iPhoto.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.iPhoto.plist

/Users//Library/Preferences/com.apple.iTunes.plist

/Users//Music/iTunes/

/Users//Music/iTunes/iTunes Media//Users//Music/iTunes/iTunes Music Library.xml

/Users//Pictures/Photo Booth /Library/Recents.plist

/Users//Pictures/Photo Booth /Library/Pictures/

/Users//Library/Caches/com.apple.PhotoBooth/


17/39

/Users//Library/Preferences/com.apple.PhotoBooth.plist

/Users//Library/Application Support/Address Book/AddressBook-v22.abcddb

/Users//Library/Preferences/com.apple.AddressBook.abd.plist

/Users//Library/Preferences/com.apple.AddressBook.plist

/Users//.Spotlight-V100/

/Users//.Spotlight-V100/Store-V//shutdown_time

/Users//Library/PubSub/Database/Database.sqlite3

/Users//Library/PubSub/Clients.plist

/Users//Library/PubSub/Feeds/

/Users//Library/Mail/V2/RSS/

/Users//Library/Saved Application State/

/Users//Library/Saved Application State//Windows.plist

/Users//Library/Preferences/

/Users//Library/Preferences/.GlobalPreferences.plist

/Users//Library/Preferences/com.apple.photobooth.plist

/Users//Library/Preferences/com.microsoft.office.plist/Users//Library/Preferences/com.apple.Calculator.plist

/Users//Library/Preferences/com.apple.Dashboard.plist

/Users//Library/Preferences/com.apple.Desktop.plist

/Users//Library/Preferences/com.apple.DiskUtility.plist

/Users//Library/Preferences/com.apple.Dock.plist

/Users//Library/Preferences/com.apple.Finder.plist

/Users//Library/Preferences/com.apple.iCal.plist

/Users//Library/Preferences/com.iChat.plist

/Users//Library/Preferences/com.apple.iMovie8.plist

/Users//Library/Preferences/com.apple.iPhoto.plist

/Users//Library/Preferences/com.apple.iWeb.plist

/Users//Library/Preferences/com.apple.iTunes.plist/Users//Library/Preferences/com.OnyX.plist

/Users//Library/Preferences/org.kismac-ng.kismac.plist

/Users//Library/Preferences/net.irradiated.Black-Hole.plist

/Users//Library/Preferences/com.aol.aim.desktop.plist

/Users//Library/Preferences/com.apple.keychainaccess.plist

/Users//Library/Preferences/com.apple.AddressBook.plist

/Users//Library/Preferences/com.apple.iApps.plist


18/39

/Users//Preferences/com.apple.sidebarlists.plist

/Users//Library/Preferences/loginwindow.plist

/Users//Library/Preferences/com.apple.loginitems.plist

/Library/LaunchAgents/

/Library/LaunchDaemons/

/Library/StartupItems/

/System/Library/LaunchDaemons/

/System/Library/StartupItems/

/Users//Library/Preferences/com.apple.Preview.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.PropertyListEditor.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.QuickTimePlayerX.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.recentitems.plist

/Users//Library/Preferences/com.apple.ScreenSharing.LSSharedFileList.plist/Users//Library/Preferences/com.apple.TextEdit.LSSharedFileList.plist

/Users//Library/Preferences/org.videolan.vlc.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.Grab.LSSharedFileList.plist

/Users//Library/Preferences/com.apple.Console.LSSharedFileList.plist

/Users//Library/Logs/

/var/log/

/Library/Logs/

/Users//Library/Preferences/com.apple.Dock.db

/Users//Library/Preferences/com.apple.iPod.plist/Users//Library/Preferences/com.apple.LaunchServices.QuarantineEvents

/Users//.bash_history

/Users//Library/Preferences/AddressBookMe.plist

/Users//Library/Application Support/

/Users//Library/Keychains/

/Users//.Trash/

/System/Library/CoreServices/SystemVersion.plist

/private/var/db/.AppleSetupDone

/Volumes/MobileBackups/

/Users//Preferences/Macromedia/Flash Player/#SharedObjects/

/Users//Preferences/Macromedia/Flash Player/support/flash player/sys/

/Users//Preferences/CD Info.cidb/Library/Preferences/com.apple.loginwindow.plist

/Library/Preferences/com.apple.Bluetooth.plist

/Library/Preferences/com.apple.SoftwareUpdate.plist

/Library/Preferences/com.apple.TimeMachine.plist

/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

/Users//.DocumentRevisions-V100/

/var/vm/sleepimage


19/39

/var/vm/swapfile#

/var/db/dslocal/nodes/Default/users/

/Users//Library/Application Support/Firefox//Users//Library/Application Support/Firefox/Profiles/

/Users//Library/Application Support/Firefox/Profiles//Cookies.sqlite

/Users//Library/Application Support/Firefox/Profiles//Downloads.sqlite

/Users//Library/Application Support/Firefox/Profiles//Formhistory.sqlite

/Users//Library/Application Support/Firefox/Profiles//Places.sqlite

/Users//Library/Application Support/Google/Chrome/

/Users//Library/Caches/com.google.Chrome/

/Users//Library/Preferences/com.google.Chrome.plist

/Users//Library/Preferences/com.google.Chrome.helper.plist/Users//Library/Preferences/com.google.Keystone.Agent.plist

/Users//.tor

/Users//.tor/State

/Users//Library/VirtualBox/

/Users//Library/VirtualBox/VirtualBox.xml

/Users//Library/VirtualBox/VBoxSVC.log/Users//Library/Caches/org.virtualbox.app.VirtualBox/

/Users//VirtualBox VMs/

/Users//Dropbox

/Users//Library/Caches/com.getdropbox.dropbox

/Users//.dropbox/

/Users//.dropbox/Config.db

/Users//.dropbox/filecache.db

/Users//Library/Application Support/Skype/

/Users//Library/Application Support/Skype//

/Users//Library/Preferences/com.skype.skype.plist

/Users//Library/Application Support/Skype//Main.db

/Users//Library/Application Support/Skype//chatsync/


20/39

/Users//Library/Application Support/Handbrake/

/Users//Library/Application Support/Handbrake/EncodeLogs/

/Users//Library/Application Support/Handbrake/HandBrake-activitylog.txt

/Users//Library/Application Support/Handbrake/Queue.plist

/Users//Library/Application Support/Handbrake/Previews/

/Users//Library/Preferences/org.m0k.handbrake.plist

/etc/hosts

/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

/Users//Library/Preferences/com.twitter.twitter-mac.plist

/Applications/Twitter.app/

/Users//Library/Caches/com.twitter.twitter-mac/Users//Library/Caches/com.twitter.twitter-mac/Cache.db

/Users//Library/Saved Application State/com.twitter.twitter-mac.savedState

/Users//Library/iCloud/Accounts/

/Users//Library/Application Support/Adium 2.0/Users/Default/Logs/

/Users//Library/Preferences/com.macpaw.CleanMyMac.plist

/Users//Library/Application Support/Evernote/

/Users//Library/Application Support/Evernote/data/

/Users//Library/Application Support/Evernote/logs/

/Users//Library/Application Support/Evernote/data//Evernote.sql

/Users//Library/Application Support/Evernote/data//Content/

/private/etc/hostconfig

/private/etc/ntp.conf

/private/var/run/ntp.drift


21/39

/Library/Logs/DirectoryService/DirectoryService.server.log

/private/var/log/asl.log


22/39

https://docs.google.com/spreadsheet/ccc?key=0AkBdGlxJhW-

Notes

Hidden directory in Lion

Not user-specific

Plist listing default and user-added Safari bookmarks

Plist listing files downloaded using Safari Browser

Plist describing installed Safari Extensions

Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension.

Plist listing Safari web browsing history

An index of Safari History allowing a user to perform keyword searches of visited webpages

A plist describing the state of Safari when it was last closed

A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .lo

A database listing the webpage specific databases

Will persist in directory after desktop picture has been changed to something else

A Plist listing the webpages belonging to a Safari's Top Sites

A database containing saved web page icons for webpages visited

A directory for webpage-specific database storage

A database that keeps track of stored webpage-specific databases

A directory containing Safari-specific cache items

A cache of data from visited webpages

A directory containing cached items for Safari Extensions

A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage U

A Plist containing cookies from visited webpages

Contains recent safari search strings and downloads folder location in addition to preferences

Each bookmark entry in Bookmarks.plist is stored as an individual file in this directory for more efficient use with Spotli

Each website entry in History.plist is stored as an individual file in this directory for more efficient use with Spotlight an

Cached images from email messages

Apple Mail Mailboxs

Synched IMAP Account(s)

Synched POP Account(s)


23/39

Backup Plist that defines the mailbox structure

Keeps track of the location of Mail messages - the content of some messages is present as well

Plist listing opened Mail attachments

Plist listing search terms entered into Mail's search box

Plist containing Mail signatures

Smart Mailbox information

Directory containing RSS feed mailboxes

Directory containing files downloaded from email messages

Mail preferences

SQLite database stored in Address Book's support directory containing recent Mail contacts

iChat preferences and user account information

User iChat icon

Recent user iChat pictures

Specialized folder that contains user's iPhoto pictures

Contains original versions of all photos

Contains modified versions of photos

Contains detailed information about iPhoto library

Directory of folders containing .ithmb photos synced to iDevice. Folder modified date/time stamp updated upon sync.

SQLite databases containing data about recognized facesPlist containing information about some iPhoto albums/events and path/photo ID info for each picture in the library

Plist containing information about some iPhoto albums/events and other iPhoto information

iPhoto Recent Items - typically only contains iPhoto Library package

iPhoto preferences

iTunes preferences

iTunes library directory

Directory containing iTunes media filesXML file defining the iTunes music library

A Plist listing the recent photos and videos taken using Photo Booth. Items deleted by the user will not be saved to thi

A directory containing the user's Photo Booth pictures

Photo Booth cache directory


24/39

Photo Booth preferences

SQLite database containing contact information

Address Book preferences

Spotlight directory containing text indexes

Last shutdown time stored as a Unix 32-bit hex value in Little Endian

SQLite database containing RSS Feed information

Plist containing RSS Feed information

A directory containing folders pertaining to the saved state of OS X applications

A property list describing the state of the windows during the applications last use

Directory containing user preference settings for applications and utilities

Global Preferences Plist

Photo Booth preferences

Office preferences and recent itemsContains recent conversions

Dashboard preferences including installed widgets

Desktop preferences including current Desktop background picture

Disk Utility preferences including recent disk images

Dock preferences including persistent apps and directories

Finder preferences including mounted volumes

iCal preferences

iChat accounts, preferences, away messages, recent chats, etc.

iMovie preferences and recent items

iPhoto preferences

iWeb preferences

iTunes preferencesOnyX preferences

KisMAC preferences

Black Hole System Cleaner Preferences & Last launch time

AIM preferences & account info

Keychain preferences including last accessed Keychain

Address Book preferences

Plist listing the paths of iApp (iTunes, iPhoto, etc.) databases


25/39

Lists the names of volumes mounted on the desktop that have appeared in the sidebar list

Plist containing applications that are launched when the user logs in

Plists listing applications that automatically start when the user is logged in

Preview recent items

Property list Editor recent items

QuickTime recent items

Recently opened applications, files, and servers

Recent screen sharesTextEdit recent items

VLC recent items

Screenshots recently taken and saved with Grab

Recent logs viewed with Console

Directory containing numerous log files

Database containing directories, files, and apps that have appeared in the Dock

Attached iDevicesSQLite database that keeps track of files that have the quarantine extended attribute that is given to applications, scri

Terminal commands history

Plist containing user information such as name, address, phone number, etc.

Contains application-specific folders used to support applications and utilities

Directory containing user keychain files

User Trash directory

Plist describing the installed Operating System

Plist listing the information entered by the user at the time of the OS setup

Local Time Machine backup directory stored on disk. Time Machine backups are created and stored here when Time

Contains Flash shared object artifacts that identify webpages visited

Contains Flash player support artifacts that identify webpages visited

A database file used to "remember" CD's (user-created & store bought). Also, the file gets updated if a user manuallyPlist containing password hints and last user logged in

Bluetooth preferences and paired devices

Plist describing last attempt and last successful attempt at updating OS X software

Time Machine backup info

Remembered wireless networks

Directory containing automatically saved versions of files

Contents of RAM are written to this file when the computer is put to sleep


26/39

Numerous swap files may be found in this directory with the naming convention of swapfile# (swapfile0, swapfile1,

Contains the salted SHA-512 hash value for the user's log in password -

http://www.defenceindepth.net/2011/09/cracking-os-x-lion-passwords.html

Directory containing user artifacts for Mozilla Firefox web browser

Text entered into forms including search terms, email addresses, and login information.

Directory containing user artifacts for Google Chrome web browser

Google Chrome cache directory

Text fie describing the version of Tor used and the last time it was ran

Directory containing VirtualBox configuration files

An XML file describing VirtualBox settings. Contains information about recently run virtual machines.

VirtualBox log fileVirtualBox cache directory

Directory for VirtualBox virtual machines

Drop Box cache directory

Hidden configuration folder for Drop Box

SQLite database containing configuration information, such as Drop Box directory path and user email account.

SQLite database containing information about files stored in Drop Box directory.

Directory containing Skype user artifacts

Directory containing Skype user artifacts

Skype preferences and recent user searches

Database of contacts, SMS's, calls, conversations, videos, messages, etc.

Directory containing chat logs


27/39

Directory for Handbrake DVD ripper

Log files for each rip

Activity log

HandBrake queue

Contains previews of unfinished rips

Handbrake preferences & last launch time

Remembered wireless networks

Twitter application folder

Twitter cache directorySQLite database file containing cached Twitter feed data

Twitter saved application state directory

directory containing Adium chat transcripts

Contains user profiles and Evernote user data

Evernote profile info - contains various information about the user's Evernote account such as last sync, titles of Ever

Contains the content of the user's Evernote data. Content stored as HTML, XML, graphics, and various other non-pro


28/39


29/39

calstorage.

RL.

ight and to allow the user to select the bookmark entry from Spotlight and have Safari launch the co

to allow the user to select the webpage entry from Spotlight and have Safari launch the correspon


30/39

list.


31/39


32/39

ts, and executables downloaded from potentially untrustworthy locations/people. The SQLite datab

Machine backup disk is not available.

enters track names in iTunes.


33/39


34/39

ote entries, urls, owner info, lat/long coords, etc.

rietary file types.


35/39


36/39

responding webpage

ing webpage


37/39


38/39


39/39

se contains URLS, email addresses, email subjects, and other potentially useful information.