sfavyo.over-blog.com/
20 Février 2021
System 7.5.1 was the first to refer to itself as Mac OS; Mac OS 7.6 was the first to be branded as 'Mac OS' Mac OS 8: 1997 1997 Macintosh computers Mac OS 9: 1999 1999 Mac OS X: Mac OS X Public Beta: September 13, 2000 September 13, 2000 May 14, 2001 Code name Kodiak; Mac OS X 10.0: September 13, 2000 March 24, 2001 Code name Cheetah; Mac OS X 10.1. Safari (web browser) – built-in from Mac OS X 10.3, available as a separate download for Mac OS X 10.2; SeaMonkey – open source Internet application suite; Shiira – open source; Sleipnir – free, by Fenrir Inc; Tor (anonymity network) - free, open source; Torch (web browser) - free, by Torch Media Inc. Internet Explorer for Mac – free. Mac's List shares 100s of real local Portland jobs. Find open jobs, learn about the Portland job market, and connect with local career resources. The Mac's List team is. If you had been looking for a Mac OS X application that allows you to keep everything in order for you then you have come to the right place. I have gathered some of the best productivity tools that offers easy to use Fast and Easy-to-Use To-Do List features. EtreTask is a small, fast, easy-to-use to-do list manager.
/Mac Tips /A Comprehensive List to Mac OS X and macOS Versions
There are a lot of versions of the Mac operating system. This is due to the fact that updates are necessary in order to make the previous version better. More features and capabilities are added to the system. In addition, issues with previous operating systems are solved as well.
As such, we will be giving the different Mac OS X and macOS versions. In this way, you will know which version of the operating system came and pass by. We will be giving you the different versions from the first one until the latest one. In addition, we will be giving you how to check which actual version of the Mac operating system you have on your computer. Before that, the latest macOS versions available are Big Sur. It'll be a new version. Instead of 10.16, this Big Sur will actually become version 11.
Article GuidePart 1. An Introduction To macOS VersionsPart 2. What Are the Mac OS Versions in Order?Part 3. The Reason Behind Mac OS X And macOS Versions' NamesPart 4. Updating To The Newest macOS VersionsPart 5. To Sum It All Up
macOS versions were initially introduced as Mac OS X. It debuted about 20 years ago. This was in September 2000. Mac OS X Public Beta was the first release on the 13th of September 2000. This was after the failure with Copland. The Mac OS X Public Beta had a code name. This was Kodiak.
The Mac OS X and macOS are the operating systems of Apple's Mac. It is bundled with different applications such as Preview, TextEdit, Terminal, and QuickTime Player. A basic MP3 player (not iTunes) was called Sketch. There are also other applications such as Quartz and HTML Edit.
Here, we will discuss a list of Mac OS X and macOS versions. We will provide a brief overview of these operating systems. Check out the Mac OS X and macOS versions below:
This was released on September 13, 2000. It costs about $29.95. It's the first operating system to feature a user interface called Aqua. It includes apps such as Preview, Mail, TextEdit, Terminal, and QuickTime Player.
This is actually the first major operating system release of Apple. It's released on March 24, 2001. The cost is about $129. Features include the Dock, Mail, Address Book, PDF Support, Aqua User Interface, Sherlock, Protected Memory, and more.
The Mac OS X version was soon named as macOS versions. Mac OS X 10.1 Puma was released on September 25, 2001. This is a free update given to the users of its predecessor. It has features such as Performance enhancements, DVD playback support, Menu Extras, improved AppleScript, ColorSync, and more.
Mac OS X is now known as macOS versions. The Mac OS X Jaguar Version 10.2 was released on August 23, 2002. It comes in single installations or in family packs. New features include QuickTime's support for MPEG-4. Inkwell was also included for handwriting recognition.
This was released on October 24, 2003. This is the fourth major release by Apple of the Mac OS X. Features include Finder, TextEdit, Xcode Developer Tools, QuickTime, Preview, Fast User Switching, and Expose, among others.
The Mac OS X versions would currently be called macOS versions. Now, the Mac OS X Tiger was released on April 29, 2005. Features include Xcode 2.0, QuickTime 7, Mail 2, Dashboard, Spotlight, VoiceOver, iChat AV, and more.
This is the upgraded version of Mac OS X Tiger 10.4, Merlot. It was released on the 10th of January 2006.
The Mac OS X versions of the operating systems are now known as macOS versions. This version of the operating system was released in October 26, 2007. New features include Dashboard, Parental Controls, Photo Booth, Spotlight, Time Machine, Universal Access, and more.
This is the 7th release of the Mac OS X, which is now known as macOS versions. It was released on August 28, 2009. Features include Mac App Store, Finder, Boot Camp, Preview, Time Machine, VoiceOver, Safari 4, and more.
This was released on July 20, 2011. New features include AirDrop, FaceTime, Finder, Font Book 3, Mac App Store, Mail 5, QuickTime, Vertical Text, Resume, and more. The Mac OS X is now known as macOS versions.
The Mac OS X versions are now known as macOS versions. It was released on July 25, 2012. Features include Notes, Notification Center, Messages, Application Updates, Game Center, and more.
This was released on October 22, 2013. System features include iCloud Keychain, Timer coalescing, Calendar, iBooks, Maps, Safari browser, and more. Functionalities removed include Open Transport API.
Mac OS X is now known as macOS versions. Mac OS X Yosemite was released on October 16, 2014. Features include Notification Center, Spotlight, Continuity, improved Design, and more.
Mac OS X is now known as macOS versions. This was released on September 20, 2015. Features include Mail, Messages, Maps, Safari, Notes, Spotlight, and Photos, among others.
One of the macOS versions was released on September 20, 2016. System features include Siri, Night Shift, Universal Clipboard, Auto Unlock, and more. Application features include iTunes, Notes, Apple Play, Safari, Photos, and more.
Another one of the macOS versions was released on September 25, 2017. This operating system is focused on providing technical updates and performance improvements, instead of added features. Changes include significant improvements in Safari and Photos.
In macOS High Sierra, the AFPS (Apple File System) replaces the so-called HFS+. Now, the AFPS is the default file system within macOS. Metal has also been upgraded to that of Metal 2. Application changes have been made including Final Cut Pro 7, Messages, Siri, Notes, Safari, Mail, Photos, and more.
Tip: If you just want to update your Mac version to the High Sierra, then you can follow this guide to do that.
This is the fifteenth release of the operating system of Apple for Mac computers. It was released on September 24, 2018. It added a few iOS apps within the operating system. These include Home, Voice Memos, and Apple News. In addition, the Dark Mode is more comprehensive.
This is one of the macOS versions and it was released on October 7, 2019. It's the first release to include the feature called Activation Lock. Changes made include Catalyst, Gatekeeper, DriverKit, Voice Control, Sidecar, Dedicated System Volume. Application upgrades include Reminders, iTunes, Find My Friends, and Find My Mac, among others.
There are components that have been changed or removed. All 32-bit applications have been removed from the Mac App Store. The Dashboard has also been removed. Zsh replaced Bash which is the shell, by default, in the Panther version of the operating system.
What is the latest version of Mac OS 2020? It must be the Beta. This includes a major redesign of the user interface. It is one of the macOS versions and is the first one that supports Mac computers that have processors that are ARM-based. The design offers a new palette of colors. In addition, there are translucency changes. Streamlining and redesigning of the Menu Bar and the Dock was also added.
A Control Center was added to toggle system volume, screen brightness, Bluetooth, and Wi-Fi, among others. It's similar to what you can find in iPadOS and iOS. Its notification center has also been redesigned. It features a user interface that's transparent. In addition, it has interactive notifications. In order to avoid tampering, the system volume has been cryptographically signed. Spotlight has been made faster and has a refined interface. Home building apps for mac.
You will notice from the list we have given above that a lot of the operating system versions (from that of 2001 up to 2012) were given names after cats. For instance, there's Cheetah, Panther, Puma, and even Mountain Lion. You will also notice that the public builds were given names after these big cats. Actually, they were coded internally using the names of wines. After that, the names were changed after that of California locations. Internally, these names were changed to different types of Apple.
In addition, the operating system names started with Mac OS X. Then, it changed its names to macOS versions afterward. They decided to rebrand the name. This is because it sites nicely with other names such as watchOS, tvOS, and iOS.
If you wish to update the Mac computer to a newer version of the operating system, this will actually be determined by the system requirements and the operating system you currently have. It can come from the Mac App Store. The newer versions can come through System Preferences and then go to Software Update.
A few years back, the system updates feature will come from the Software Update. It has been in these years that they are seen in the Mac App Store. Colorsnapper 2 1 3 2. In terms of Mojave, which was released in 2018, a brand new pane within its System Preferences has been included. This is where you can see the Software Updates part.
To get the newer macOS versions, you can go to System Preferences. This is located within your Apple menu. Select System Preferences from the Apple logo. The Apple logo can be found within the upper left part. It is possible that you're taken towards the pane for Software Update. If you are not taken towards it, you can click the icon for Software Update. The Mac computer will then locate an update if it is available. If there is one available, you will have to click Update Now.
There are Mac computers that will automatically update themselves. Here are the steps you should follow in order to update your Mac automatically to the latest macOS versions:
In Catalina Or Mojave:
Within High Sierra And Earlier macOS Versions:
Here, we have discussed the different macOS versions. Mac keyboard alternative. We have also given an overview of these operating systems on your Mac. Our guide also gave you ways to automatically update your Mac to the newer macOS versions. This was given in the latter part of the article. The names given to these operating systems came from big cats. Then, it was changed to that of different names of locations in California. You will notice that the latest operating system, Big Sur, is now version 11 instead of being a version 10-point-digit.
As such, you can easily update your macOS versions from the Mac App Store. Or, you can get them through updates on the System Preferences of your Mac computer. Some computers update automatically as well.
There are a lot of operating systems within macOS versions. That's why you have to choose which one suits you best. This is because each operating system version has its own features, capabilities, and limitations. In addition, there are operating systems that are speedier compared to others. In addition, performance and technical updates have been made to these operating systems to make them a great option for users.
ExcellentThanks for your rating.
Rating: 4.6 / 5 (based on 108 ratings)
People Also Read:
PowerMyMac
A powerful all-in-one App for Mac
Free DownloadClean up and speed up your Mac with ease
Free DownloadIs your Mac up to date with the latest version of the Mac operating system? Is it using the version required by some product that you want to use with your Mac? Which versions are earlier (older) or later (newer, more recent)? To find out, learn which version is installed now.
If your macOS isn't up to date, you may be able to update to a later version. https://eghsq.over-blog.com/2021/02/simple-recorder-1-7-1-menu-bar-recorder-utility.html.
From the Apple menu in the corner of your screen, choose About This Mac. You should see the macOS name, such as macOS Mojave, followed by its version number. If you need to know the build number as well, click the version number to see it.
These are all Mac operating systems, starting with the most recent. When a major new macOS is released, it gets a new name, such as macOS Big Sur. As updates that change the macOS version number become available, this article is updated to show the latest version of that macOS.
If your Mac is using an earlier version of any Mac operating system, you should install the latest Apple software updates, which can include important security updates and updates for the apps that are installed by macOS, such as Safari, Books, Messages, Mail, Music, Calendar, and Photos.
| macOS | Latest version |
|---|---|
| macOS Big Sur | 11.0.1 |
| macOS Catalina | 10.15.7 |
| macOS Mojave | 10.14.6 |
| macOS High Sierra | 10.13.6 |
| macOS Sierra | 10.12.6 |
| OS X El Capitan | 10.11.6 |
| OS X Yosemite | 10.10.5 |
| OS X Mavericks | 10.9.5 |
| OS X Mountain Lion | 10.8.5 |
| OS X Lion | 10.7.5 |
| Mac OS X Snow Leopard | 10.6.8 |
| Mac OS X Leopard | 10.5.8 |
| Mac OS X Tiger | 10.4.11 |
| Mac OS X Panther | 10.3.9 |
| Mac OS X Jaguar | 10.2.8 |
| Mac OS X Puma | 10.1.5 |
| Mac OS X Cheetah | 10.0.4 |
Apple Property List: Dennis Browning |
Abstract
This paper will introduce the Property Lists in the Apple OS X and compare them to the Microsoft Windows Registry. Also within this paper we will examine how important some of the Property List can be to an examination. Examples of crucial information that can be found within Property List will be presented.
Acknowledgement
Let it be noted that this paper is by no means a complete look into the property lists and Mac OS X. All information looked at this in this paper has been the product of personal research. All opinions expressed in this paper are those of the authors.
Introduction
The Importance of Plist Examinations
In 2007, Derrick Farmer, a Champlain College student, wrote a paper entitled A Forensic Analysis of the Windows Registry. This paper explored some of the key locations of where vital information could be found during a computer investigation. In Farmers paper, he explores areas of the registry pertaining to the location of autorun locations, recent items, wireless networks, Internet history, and 3rd party software that has been installed on a Windows machine. In todays world, Macintosh (Mac) computers are becoming very popular. For this reason, it is important for forensic examiners to understand where they can find similar information in Mac OS X as they would find in Windows. Property Lists are very similar to that of the Windows Registry. These files contain information that can make or break a case. In this paper I will be comparing the Mac version to the Registry entries found in Windows.
History
First off, it is important to know what a Property List (plist) actually is, and the type of information that can be stored within them. Apple Developers describe the plist as follows, property lists organize data into named values and lists of values using several object types. These types give you the means to produce data that is meaningfully structured, transportable, storable, and accessible, but still as efficient as possible (Property List Programming Topics, 2008). Plists can be considered the registry for OS X. A little later we will explore the structure of a plist file. The information contained within these files is different for each program on the system. Each contains the settings for the program, which calls the plist. Similar to Windows Registry entries, if you change any value set in the file, the program will run differently. It should be noted that plist are not a Mac OS X item. They are actually found within Linux and Unix distributions.
Structure of Property List
Plists can take one of three different formats. The most recent, and more common, format one will see is the XML format. This format is more portable then that of the alternatives and can be edited manually where as the other two options are not. The other two formats are binary and ASCII. Binary formats are still used today but, one will rarely find an ASCII formatted plist. Binary formatted plists will perform faster if the plist is a large collection of data. Figure 1 below shows the XML formatted plist viewed using the program TextEdit, which comes installed on all Macs. It is obviously very hard to read in this format. If you were to open this same file in a plist editor one can clearly see the structure of the file better as seen in Figure 2.
Figure 1 TextEdit
Figure 2 Plist Editor Pro
Plists can be composed of one or two forms of structured data, Core Foundation or Cocoa. Core Foundation is described as follows by Apple Developers, Core Foundation is a procedural C framework that is conceptually modeled on the object-oriented Foundation framework in Cocoa and that uses the abstraction of the opaque type as a procedural analog to an object (Getting Started with Core Foundation, 2006). Cocoa is described as follows by Apple Developers, Cocoa is Apple's name for the collection of frameworks, APIs, and accompanying runtimes that make up the development layer of Mac OS X (Cocoa). For more information on Cocoa and Core Foundation, please refer to the links in the reference. Figure 3 below shows a table of the plist types and various representations.
Figure 3 Taken from:
http://developer.apple.com/documentation/Cocoa/
Conceptual/PropertyLists/AboutPropertyLists/
AboutPropertyLists.html#//apple_ref/doc/
uid/10000048i-CH3-46719-CJBIGFCD
Examination Tools
There are many different tools available to forensic examiners to use for plist examinations. The tools used in this paper to analyze and parse through the plist files are Fat Cat Softwares Plist Edit Pro and Echo Ones File Juicer. Plist EditPro has a free trial period that was used for this research and can be obtained from http://www.fatcatsoftware.com/plisteditpro/. File Juicer also has a free trial period that was used for this research paper. File Juicer can be obtained from http://echoone.com/filejuicer/. Both programs were fully functional during the trials.
Plist Examination
Free game king keno.
Plist as Logs
In most cases, data is only written to plists on the initial install of a program or when OS X is first installed. In all other cases plists are written each time a program is run. For the purpose of this paper, the plists that are being looked at are updated each time they are used. We will be looking at plist files related to the following: autorun locations, recent items, wireless networks, mounted devices, Internet history, and installed programs, as they relate to their Mac OS X equivalent locations.
Autorun Locations
Derrick Farmer defines autorun locations as Registry keys that launch programs or applications during the boot process (Farmer, D, 2007). This has a very similar meaning in the Mac world. On a Mac, the location of this information is in the loginitems.plist. An examiner should look at this location to see what programs or applications are of any evidentiary value to the case. For the most part, when someone installs a program on a Windows machine, the program has a default setting of starting on boot. For example, AOL Instant Messenger (AIM), when installed, will automatically start on start-up unless told otherwise. On the Mac side of installations, this is not as accurate. If one wants to have a program start on login/boot, they must tell the program to do so. It would be beneficial for examiners to look at the startup items, as it would be proof that the user of that Mac intended for the program to start on login/boot. The loginitems.plist can be found in the following location: /user/Library/Preferences/com.apple.loginitems.plist.
Recent Items
In the Windows environment, the registry contains entries for Most Recently Used (MRU) list, and User Assist. https://rhqsbm.over-blog.com/2021/02/top-video-editing-apps-for-windows.html. The MRU is a list of recent programs and files accessed. Multiple lists are created throughout the registry. MRUs are similar to the history that one can view in an Internet browser. The sites that have been most recently visited are kept in a list for the user to go back to if needed. In addition to the MRU, Windows has the UserAssist entry. This entry holds information about the most frequent programs used by a user. These entries are actually encrypted using the ROT-13 algorithm. To learn more about ROT-13, please visit the following site: http://en.wikipedia.org/wiki/Rot13.
In the Mac environment, these lists are more limited. During the research for this paper, only one location could be found with recently open items. Within the /user/Library/Preferences/com.apple.recentitems.plist, the last 10 accessed applications, documents, hosts, and servers are listed. Within the settings for each section, a user can increase or decrease the amount of records that are kept. By default, Mac OS X keeps track of the last 10. Figure 4a below shows an entry into the applications section of the plist. Figures 4b and 4c show the most recent files opened and hosts connected to, respectively.
Figure 4a Most Recent Application Run
Figure 4b Most Recent File Opened
Figure 4c Most Recent Host/Computer Connected to
The information that can be found in this plist, unfortunately is only available as long as it been one of the last items opened in its respective section. Although, it can be beneficial for an examiner, if the user has only connected to a select few hosts.
Wireless Networks
In a forensic investigation, being able to determine if a suspects computer was connected to a wireless network could be of evidentiary value. The SSID or service set identifier is recorded for all wireless networks that are added to the users preferred network connections. This can include connections to Wi-Fi hotspots at Starbucks or similar hotspots. In the Windows Registry, SSIDs are stored in one key and the settings, such as the IP address, subnet mask and other information about a particular network is stored in another key. This is similar on a Mac. The two important plists to look at can be found at the following locations: /hd/Library/Preferences/SystemConfiguration/com.apple.airport.prefrences.plist and /hd/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist. By using the two of these files together, an examiner can see the last date that the computer was connected to that network by looking at the com.apple.airport.preferences.plist. For example, figure 5a shows the SSID of 3dd. Also, you can see that the security type and password are shown. The password is hashed.
Figure 5a com.apple.airport.preferences.plist
Once the examiner has the timestamp found in the Airport Preferences plist, they can then go to the Network Identification plist. In there they will find the corresponding date on an entry to find out more information about the network including: DNS servers, IP address, the interface used (wired or wireless), subnet mask, and router IP. Figures 5b-5d show the information.
Figure 5b Timestamp Match to figure 5a
Figure 5c DNS servers connected to
Figure 5d IP address obtained, router IP and Subnet Mask
Based on the above information, an examiner can determine if or when a suspect was connected to a network. An examiner can use the DNS Servers to find out the Internet Service Provider (ISP) to which the suspect connected to the Internet with. Many ISPs keep record of the hardware address that is obtaining an IP address from them. By getting a subpoena, an examiner can get log histories for the owner of the network.
Mounted Devices
USB devices and other mounted devices, such as CD/DVD installers, are almost an everyday occurrence now. A feature of the USB devices registry key found on a Windows machine is that the serial number for the USB device is recorded, making it easier to prove that a certain USB was connected to the suspects computer. Some USB devices dont have a serial number so a random string is created in place of the serial number. On a Mac, this is not true. While a Mac does recorded that a USB device was connected to a machine, it does not record the serial number of that device. On the Mac, the plist /user/Library/Preferences/com.apple.finder.plist, shows all devices, whether it is a USB device, image, CD, DVD, or iPod, that are connected to the computer while logged in as a certain user. In this plist, the location of where the Finder opened the item is recorded under the FXDesktopVolumesPositions Key. The Finder is Macs version of Explorer in Windows. If a USB device or CD has an unique name, this plist is useful to show that at some point, the device was mounted on the suspects computer. In figure 6a you can see Volumes that were mounted. Volumes can include USB devices, CDs, DVDs, and iPods.
Figure 6a Volumes Mounted
When a user downloads a program on a Mac, a .dmg file is opened in order to install the program. This is equivalent to an installed .exe in Windows. On the Mac, these files are mounted in order for the user to see the install program. These files are also noted in this plist. Figure 6b shows an example of some .dmg files that have been mounted.
Figure 6b Software DMG's
An examiner can use this list to see if software was ever downloaded onto the computer. For example, if an examiner is looking through a Mac to see if any kind of encryption software has been installed, it can be seen here that TrueCrypt was downloaded and mounted at some point. If the suspect says they have never looked into encryption software, the examiner can prove that they have.
iPods
In todays music loving world, many people now have some form of MP3 player. With the advancement of technology, criminals are starting to hide information on iPods. On the Mac, the following plist can be informative to an examiner: /user/Library/Preferences/com.apple.iPod.plist. With this file, the examiner can verify if an iPod has been connected to that computer. In figure 7 you can see that an iPod has been connected to the computer.
Figure 7 iPod Information /user/Library/Preferences/com.apple.iPod.plist
With the information found in the above plist, an examiner can check the serial number to an iPod to see if it has been connected. If, in a case, a suspect states that they do not have an iPod, this file can show that an iPod has been used. The connected date shown above, shows the last date the iPod was in use on the suspects computer. The examiner can also prove how many times the iPod has been connected to that computer by the use count variable shown above.
Internet History
Safari
Safari is the native Internet browser on a Mac. This is similar to Internet Explorer on a Windows machine. In Windows, the Internet Explorer Registry key has three subkeys, which include: main, typedURLs and download directory. On a Mac, Safari has a similar setup. Plists related to browsing history, download history, and cookies, each have their own location. In Internet Explorer, temporary internet files are stored as cache files, which is similar in Safari. These file are located in /user/Library/Caches/Safari. Using File Juicer, an examiner can view the contents of the caches files. File Juicer will take the Cache.db file found in the locations previously mentioned and parse through it, breaking cached items into folders of similar extensions. Figure 8a shows the folder created once File Juicer has processed the caches data.
Figure 8a File Juicer Results
The above listed index.html file, is a webpage created by File Juicer that contains all images found in the Safari Cache. This program makes it easier for an examiner to parse through potential evidence.
Another great place to look for evidence is the browser history. The plist found at /user/Library/Safari/History.plist provides an examiner with the Safari browser history. Figure 8b shows an example of the record in the plist.
Figure 8b Browser History
From the information found in this entry, an examiner can tell that the user visited this site nine times. The value found in lastVistedDate is formatted in absolute time and date. This can easily be converted using a program such as CFAbsoluteTimeConverter. This program can be downloaded from the following link: http://www.hsoi.com/hsoishop/software/. All that needs to be done is copy and paste the value into the program. The above value is converted to tell the examiner that the page was last visited on Sunday 07 September 2008 10:41:04 am. Time and dates are always great supporting evidence to help prove a suspect committed an act.
The downloads.plist file is another file for the examiner to look at for evidentiary information. This file provides an examiner with files that were downloaded using Safari. This plist can be found in the /user/Library/Safari/ directory as well. When looking at the information found in this plist, an examiner can prove that a program, such as Limewire, has been downloaded on the suspects computer. Figure 8c shows the entry in the downloads.plist that can prove that Limewire was indeed downloaded.
Figure 8c Download.plist
These files are great places to look for evidence. In Safari 3.2.1, similar to Internet Explorer 7, users can now clear all cookies, download history, cache, and all the great information examiners look for. If the user is smart enough to do this, the above plists get cleared and are of no use to an examiner.
Firefox
When looking at alternative web browsers, such as Firefox, Opera, and Netscape, on a Windows machine, the information is recorded differently. On a Mac, this is similar. Since Firefox is not the native browser, information is stored differently. This folder can be found at /user/Library/Application Support/Firefox/Profiles. An examiner can take the profile folder and run it through File Juicer. File Juicer will again parse through all the files and provide the examiner with a folder with items in their respective folders. One difference here is when a user tells Firefox 2.0 or higher to clear its history, caches, etc., the typed URLs are not cleared. A list of these URLs can be found in File Juicers subfolder named URLs. If an examiner looks at the HTML page created, they will see a list of all URLs that the enter key has been hit for. An example can be found in figure 8d.
Figure 8d URL's
How to open avi files on mac.
Other browser, such as Opera and Netscape, are similar to Firefox. They have a folder in the application support, which can be found to contain all information needed.
Applications
Similar to the Windows world, when a user installs a program, a folder is then created for that piece of software. In Windows, the folder is usually created in the program files folder, and contains executable and other important files. Some files may also be placed in other directories. On a Mac, the executable is placed in the applications folder, and all other important files needed to run the program are placed in the application support folder found at /user/Library/. In Windows, for the most part, when a user uninstalls a program, all files and folders related to that program are subsequently deleted as well. On a Mac, this is not true. When a user uninstalls or deletes a program, all they are doing is removing the executable from the applications folder. The application support folder will still contain all of the files associated with that program. The examiner can now go in and see what programs have been installed on the machine even if the program has been deleted.
Just to show what some of the information that can be found in the application support folder, we will take a look at the folder for the program Adium. Figure 9a shows the Adium Folder.
Figure 9a Adium Application Folder
An examiner should be interested in the usernames that are associated with an instant messaging program like Adium. When the users folder is opened, the default user is the only one listed. When that folder is opened, an examiner has access to all of the settings and accounts that have been setup. Figure 9b shows the account setup under the default user account.
Figure 9b AIM user account
With the program Adium, a user can setup accounts for Facebook, MSN, Jabber, Yahoo and many others. If a user has setup multiple accounts, they would all be listed in the account.plist.
Within this users folder, there is another folder for logs. This log folder contains chat logs for every screen name the user has talked to. The chat logs are formatted as XML sites. Figure 9c shows part of a chat log.
Figure 9c Chat log
An examiner can use these logs to see the time and date of when a message was sent. Also by looking at the above figure, the examiner can see the user who sent the message and if the user has setup an alias for the screen name they are talking to.
Overview
The following list includes all of the plist entries that were discussed in this paper.
Conclusion
With the growing popularity of Macs in todays technological world, it is important that Forensic Examiners have the knowledge of the location of potential evidentiary information on a Mac. Having a basic knowledge of the Mac OS X file structure and Linux file structure will only help an examiner comprehend what they are looking at. By knowing where the information is and how to interpret that information, an examiner can be confident when going into an investigation that involves a Mac. The files discussed in this paper are only a few of the many possible evidentiary locations that an examiner should look at.
References
Cocoa. (n.d.). Retrieved April 5, 2009, from http://developer.apple.com/cocoa/
Farmer, D. (2007.). Computer Forensics – A Forensic Analysis Of The Windows Registry. Retrieved March 1, 2009, from http://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry
Fat Cat Software – PlistEdit Pro. (n.d.). Retrieved March 6, 2009, from http://www.fatcatsoftware.com/plisteditpro/
Getting Started with Core Foundation. (2006, November 7). Retrieved April 5, 2009, from http://developer.apple.com/referencelibrary/GettingStarted/
GS_CoreFoundation/index.html#//apple_ref/doc/uid/TP30001089
Hsoi's Shop: Software . (n.d.). Retrieved April 5, 2009, from http://www.hsoi.com/hsoishop/software/
Mac OS X Manual Page For plist(5). (2003.). Retrieved March 6, 2009, from http://developer.apple.com/documentation/Darwin/Reference/ManPages/man5/plist.5.html
Property List Programming Guide: About Property Lists. (2008.). Retrieved March 6, 2009, from http://developer.apple.com/documentation/Cocoa/Conceptual/
PropertyLists/AboutPropertyLists/chapter_3_section_1.html#/
/apple_ref/doc/uid/10000048i-CH3-SW2
Property List Programming Topics for Core Foundation: Introduction to Property List Programming Topics for Core Foundation. (2008.). Retrieved March 6, 2009, from http://developer.apple.com/documentation/
CoreFoundation/Conceptual/CFPropertyLists/CFPropertyLists.html
Read Me – File Juicer for Mac OS X. (2008, December 30). Retrieved March 2, 2009, from http://echoone.com/filejuicer/ReadMe
ROT13 – Wikipedia, the free encyclopedia. (n.d.). Retrieved April 5, 2009, from http://en.wikipedia.org/wiki/Rot13
(2008). Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit. US: Syngres
Appendix:
Below you will find a table showing the Windows Registry Key location and the Mac OS X plist location of the information discussed in this paper.
| Info | Windows | Mac OS X |
| AutoRun |
| user folder Library/ Preferences/ com.apple.loginitems.plist |
| Recently Items |
| user folder Library/ Preferences/ com.apple.recentitems.plist |
| Wireless |
| root Library/ Preferences/ SystemConfiguration/ com.apple.airport.preferences.plist root |
| USB and Mounted Devices |
| user folder Library/ Preferences/ com.apple.finder.plist |
| Native Browser |
| user folder Library/ Caches/ Safari user folder |
| Software |
| user folder Library/ Application Support/ |
/image%2F6288339%2F20210221%2Fob_742ce7_mac-os-or-windows.png)
/image%2F6288339%2F20210221%2Fob_2c6a45_best-browser-for-mac-2019.jpeg)
/image%2F6288339%2F20210221%2Fob_eb6a84_best-new-mac-apps.jpeg)
/image%2F6288339%2F20210221%2Fob_df39e0_instalar-rar-mac.jpeg)