Difference between pages "Oxygen PM II" and "Mac OS X"
From Forensics Wiki
(Difference between pages)
(Placing redirect to Oxygen Forensic Suite 2.) |
Joachim Metz (Talk | contribs) (→Quarantine event database) |
||
| Line 1: | Line 1: | ||
| − | + | {{Expand}} | |
| − | + | ||
| − | {{ | + | |
| − | + | Apple Inc.'s Macintosh OS X (pronounced "'''OS Ten'''") is the operating system distributed with Apple computers. It includes heavily used several programs by default, including [[Apple Mail]], a web browser called [[Apple Safari | Safari]], and an [[Apple Address Book]], and [[iCal]]. | |
| − | + | == Quarantine event database == | |
| + | See [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/] | ||
| − | + | Snow Leopard and earlier | |
| + | <pre> | ||
| + | /Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEvents | ||
| + | </pre> | ||
| − | + | <pre> | |
| + | SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch") as LSQuarantineTimeStamp, LSQuarantineAgentName, LSQuarantineOriginURLString, LSQuarantineDataURLString from LSQuarantineEvent; | ||
| + | </pre> | ||
| − | + | Lion and later | |
| − | + | <pre> | |
| − | + | /Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 | |
| − | + | </pre> | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | == | + | == Package Files (.PKG) == |
| + | Package Files (.PKG) are XAR archives [http://en.wikipedia.org/wiki/Xar_(archiver)] that contain a cpio archive and metadata [http://s.sudre.free.fr/Stuff/Ivanhoe/FLAT.html]. | ||
| − | === | + | == Also see == |
| − | [http://www. | + | * [[MacOS Process Monitoring]] |
| + | * [[Acquiring a MacOS System with Target Disk Mode]] | ||
| + | |||
| + | == External Links == | ||
| + | |||
| + | * [http://www.apple.com/macosx/ Official website] | ||
| + | * [http://en.wikipedia.org/wiki/OS_X Wikipedia entry on OS X] | ||
| + | * [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/ Quarantine event database] | ||
| + | |||
| + | [[Category:Mac OS X]] | ||
| + | [[Category:Operating systems]] | ||
Revision as of 07:30, 8 June 2012
|
Please help to improve this article by expanding it.
|
Apple Inc.'s Macintosh OS X (pronounced "OS Ten") is the operating system distributed with Apple computers. It includes heavily used several programs by default, including Apple Mail, a web browser called Safari, and an Apple Address Book, and iCal.
Contents |
Quarantine event database
See [1]
Snow Leopard and earlier
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch") as LSQuarantineTimeStamp, LSQuarantineAgentName, LSQuarantineOriginURLString, LSQuarantineDataURLString from LSQuarantineEvent;
Lion and later
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
Package Files (.PKG)
Package Files (.PKG) are XAR archives [2] that contain a cpio archive and metadata [3].