In this paper I will be comparing the Mac version to the Registry entries found in Windows.įirst off, it is important to know what a Property List (plist) actually is, and the type of information that can be stored within them. These files contain information that can make or break a case. Property Lists are very similar to that of the Windows Registry.
#Juicer 3 manually edit preferences.xml mac os x#
For this reason, it is important for forensic examiners to understand where they can find similar information in Mac OS X as they would find in Windows. In today’s world, Macintosh (Mac) computers are becoming very popular. In Farmer’s paper, he explores areas of the registry pertaining to the location of autorun locations, recent items, wireless networks, Internet history, and 3rd party software that has been installed on a Windows machine. This paper explored some of the key locations of where vital information could be found during a computer investigation. In 2007, Derrick Farmer, a Champlain College student, wrote a paper entitled “A Forensic Analysis of the Windows Registry”. All opinions expressed in this paper are those of the authors. All information looked at this in this paper has been the product of personal research. Let it be noted that this paper is by no means a complete look into the property lists and Mac OS X. Examples of crucial information that can be found within Property List will be presented. Also within this paper we will examine how important some of the Property List can be to an examination. This paper will introduce the Property Lists in the Apple OS X and compare them to the Microsoft Windows Registry.