OS X Lion Artifacts By: Sean Cavanaugh Last Modified: 12/19/2011 - added some links to helpful articles Artifact User

Directories Downloads Directory Documents Directory Music Directory Desktop Directory Library Directory Movies Directory Pictures Directory Public Directory Sites Directory Applications Applications

Safari Safari Bookmarks Safari Downloads Safari Installed Extensions Safari Extensions Safari History Safari History Index Safari Last Session Safari Local Storage Directory Safari Local Storage Database Safari Saved Desktop Image Safari Top Sites Safari Webpage Icons Database Safari Webpage Databases Safari Webpage Databases Database Safari Cache Directory Safari Cache Safari Extensions Cache Safari Webpage Previews Safari Cookies Safari Preferences Safari Saved Application State Directory Safari Bookmark Cache Safari History Cache

Mail Mail Cache Mail Mailbox Directory Mail IMAP Synched Mailboxes Mail POP Synched Mailboxes

Mail BackupTOC Mail Envelope Index Mail Opened Attachments Mail Search History Mail Signatures by Account Mail Smart Mailbox Info Mail RSS Feeds Mail Downloads Directory Mail Preferences Mail Recent Contacts

iChat iChat Preferences Saved Chats Icon Recent Pictures iChat AIM Plist iChat Jabber Plist iChat Yahoo Plist iChat Status Messages Plist iChat PubSub Plist

iPhoto iPhoto Library Original Photos Modified Photos iPhoto Main Database iDevice Photo Cache Face Recognition Artifacts Album Data Album Data 2 iPhoto Spotlight File iPhoto Recent Items iPhoto Preferences iPhoto Trash - See Apple Examiner paper

iTunes iTunes Preferences iTunes Library Directory iTunes Media iTunes Library Structure

Photo Booth Recent Pictures Photo Booth Pictures Directory Cache

Photo Booth Preferences

Address Book Address Book Database Address Book Last Configuration Fetch Address Book Preferences

Spotlight Spotlight Directory Shutdown Time

RSS RSS Feeds Database RSS Feed Plist Feeds Directory Mail RSS Mailbox Directory

Saved Application State Saved Application State Directory Saved Application Window Plist

Preferences Preferences Directory Global Preferences Photo Booth Preferences Microsoft Office Preferences and Recent Items Calculator Preferences Dashboard Preferences Desktop Preferences Disk Utility Preferences Dock Preferences Finder Preferences iCal Preferences iChat Preferences iMovie Preferences iPhoto Preferences iWeb Preferences iTunes Preferences OnyX Preferences KisMAC Preferences Black Hole System Cleaner Preferences AOL Instant Messenger Preferences Keychain Preferences Address Book Preferences iApps Database Preferences

Sidebar Lists Preferences

Autorun Locations Login Window Login Items Library Launch Agents Library Launch Daemons Library Startup Items System Launch Daemons System Startup Items

Recent Items Preview Recent Items Property List Editor Recent Items QuickTime Recent Items Recent Items Screen Sharing Recent Shares TextEdit Recent Items VLC Video Player Recent Items Grab Screen Shot Recent Items Console Recent Items

Misc. Logs Directory Misc. Logs Misc. Logs Dock database Attached iDevices Launch Service Quarantine Events Terminal Commands History Owner Information Plist Application Support Directory Keychain Directory Trash OS Version Plist User Setup Plist Mobile Backups Directory Flash Shared Objects Flash Player Support CD Information Database Login Window Info Bluetooth Preferences Software Update Time Machine Info Remembered Wireless Networks Document Revisions Directory Sleep Image File

Swap Files User Log In Password Hash Plist

Firefox Firefox Directory Firefox Profiles Firefox Cookies Firefox Downloads Firefox Form History Firefox History

Google Chrome Chrome Directory Chrome Cache Preference Files Chrome Helper File Chrome Update Plist

Tor Hidden Tor Directory State File

VirtualBox VirtuaBox Directory VirtualBox Settings VirtualBox Log File VirtualBox Cache Directory VirtualBox VM Directory

Drop Box Shared Folder Drop Box Cache Folder Drop Box Config Folder Drop Box Config Database Drop Box File Cache

Skype Skype Directory User profile Skype Preferences and Recent Searches Main Skype database Chat Sync Directory

Handbrake DVD Ripper Handbrake Directory Logs Activity Log Queue Previews Directory Preferences & Last Launch

Networking Hosts file Remembered Wireless Networks

Twitter Twitter Preferences Application Twitter Cache Directory Twitter cache file Twitter Saved Application State Directory

iCloud iCloud Accounts

Adium Chat Client Chat Transcripts

CleanMyMac Preferences and Settings

Evernote Evernote Application Support Directory Evernote Data/Profile Directory Evernote Logs Evernote Profile Info Evernote User Content

Network Time Protocol (NTP) Validation Logs Hostconfig FIle NTP Config File NTP Drift File

Sleep State Logs

Directory Service Server Log Apple System Log

scavanaugh@appleexaminer.com Twitter: @spcavanaugh Name

Downloads Documents Music Desktop Library Movies Pictures Public Sites Applications Applications

Bookmarks.plist Downloads.plist Extensions.plist Extensions History.plist HistoryIndex.sk LastSession.plist LocalStorage StorageTracker.db Safari Desktop Picture.jpg TopSites.plist WebpageIcons.db Databases Databases.db com.apple.Safari Cache.db Extensions Webpage Previews Cookies.plist com.apple.Safari.plist com.apple.Safari.savedState Bookmarks History

Cache.db Mailboxes IMAP-<name@address> POP-<name@address>

BackupTOC.plist Envelop Index OpenedAttachments.plist SearchHistory.plist SignaturesByAccount.plist SmartMailboxes.plist RSS Mail Downloads com.apple.Mail.plist MailRecents-v4.abcdmr

com.apple.iChat.plist iChats Pictures iChat Recent Pictures com.apple.iChat.AIM.plist com.apple.iChat.Jabber.plist com.apple.iChat.Yahoo.plist com.apple.iChat.StatusMessages.plist com.apple.iChat.PubSub.plist

iPhoto Library Originals Modified iPhotoMain.db iPod Photo Cache face.db, face_blob.db AlbumData.xml AlbumData2.xml iPhoto.ipspot com.apple.iPhoto.LSSharedFileList.plist com.apple.iPhoto.plist http://www.appleexaminer.com/files/iPhoto_Trash_Analysis.pdf

com.apple.iTunes.plist iTunes iTunes Media iTunes Music Library.xml

Recents.plist Pictures com.apple.PhotoBooth

com.apple.PhotoBooth.plist

AddressBook-v22.abcddb com.apple.AddressBook.abd.plist com.apple.AddressBook.plist

.Spotlight-V100 shutdown_time

Database.sqlite3 Clients.plist Feeds RSS

Saved Application State Windows.plist

Preferences .GlobalPreferences.plist com.apple.PhotoBooth.plist com.microsoft.office.plist com.apple.Calculator.plist com.apple.Dashboard.plist com.apple.Desktop.plist com.apple.DiskUtility.plist com.apple.Dock.plist com.apple.Finder.plist com.apple.iCal.plist com.apple.iChat.plist com.apple.iMovie8.plist com.apple.iPhoto.plist com.apple.iWeb.plist com.apple.iTunes.plist com.apple.OnyX.plist org.kismac-ng.kismac.plist net.irradiated.Black-Hole.plist com.aol.aim.desktop.plist com.apple.keychainaccess.plist com.apple.AddressBook.plist com.apple.iApps.plist

com.apple.sidebarlists.plist

loginwindow.plist com.apple.LoginItems.plist LaunchAgents LaunchDaemons StartupItems LaunchDaemons StartupItems

com.apple.Preview.LSSharedFileList.plist com.apple.PropertyListEditor.LSSharedFileList.plist com.apple.QuickTimePlayerX.LSSharedFileList.plist com.apple.RecentItems.plist com.apple.ScreenSharing.LSSharedFileList.plist com.apple.TextEdit.LSSharedFileList.plist org.videolan.vlc.LSSharedFileList.plist com.apple.Grab.LSSharedFileList.plist com.apple.Console.LSSharedFileList.plist

Logs log Logs com.apple.Dock.db com.apple.iPod.plist com.apple.LaunchServices.QuarantineEvents .bash_history AddressBookMe.plist Application Support Keychains .Trash SystemVersion;plist .AppleSetupDone MobileBackups #SharedObjects sys CD Info.cidb com.apple.loginwindow.plist com.apple.Bluetooth.plist com.apple.SoftwareUpdate.plist com.apple.TimeMachine.plist com.apple.airport.preferences.plist .DocumentRevisions-V100 sleepimage

swapfile# <user name>.plist

Firefox Profiles Cookies.sqlite Downloads.sqlite Formhistory.sqlite Places.sqlite

Chrome com.google.chrome com.google.Chrome.plist com.google.Chrome.helper.plst com.google.Keystone.Agent.plist

.tor State

VirtualBox VirtualBox.xml VBoxSVC.log org.virtualbox.app.VirtualBox VirtualBox VMs

Dropbox com.getdropbox.dropbox .dropbox Config.db filecache.db

Skype <Skype user name> com.skype.skype.plist Main.db chatsync

Handbrake EncodeLogs HandBrake-activtylog.txt Queue.plist Previews org.m0k.handbrake.plist

hosts com.apple.airport.preferences.plist

com.twitter.twitter-mac.plist Twitter com.twitter.twitter-mac Cache.db com.twitter.twitter-mac.savedState

Accounts

Logs

com.macpaw.CleanMyMac.plist

Evernote data logs Evernote.sql Content

hostconfig ntp.conf ntp.drift

DirectoryService.server.log asl.log

Want to add to the list? Email artifact info to scavanaugh@appleexaminer.com http://tinyurl.com/63l2l6k Path

/Users/<user>/Downloads/ /Users/<user>/Documents/ /Users/<user>/Music/ /Users/<user>/Desktop/ /Users/<user>/Library/ /Users/<user>/Movies/ /Users/<user>/Pictures/ /Users/<user>/Public/ /Users/<user>/Sites/ /Users/<user>/Applications/ /Applications/

/Users/<user>/Library/Safari/Bookmarks.plist /Users/<user>/Library/Safari/Downloads.plist /Users/<user>/Library/Safari/Extensions/Extensions.plist /Users/<user>/Library/Safari/Extensions/ /Users/<user>/Library/Safari/History.plist /Users/<user>/Library/Safari/HistoryIndex.sk /Users/<user>/Library/Safari/LastSession.plist /Users/<user>/Library/Safari/LocalStorage/ /Users/<user>/Library/Safari/LocalStorage/StorageTracker.db /Users/<user>/Library/Safari/Saved Desktop Picture.jpg /Users/<user>/Library/Safari/TopSites.plist /Users/<user>/Library/Safari/WebpageIcons.db /Users/<user>/Library/Safari/Databases/ /Users/<user>/Library/Safari/Databases/Databases.db /Users/<user>/Library/Caches/com.apple.Safari/ /Users/<user>/Library/Caches/com.apple.Safari/Cache.db /Users/<user>/Library/Caches/com.apple.Safari/Extensions/ /Users/<user>/Library/Caches/com.apple.Safari/Webpage Previews/ /Users/<user>/Library/Cookies/Cookies.plist /Users/<user>/Library/Preferences/com.apple.Safari.plist /Users/<user>/Library/Saved Application State/com.apple.Safari.savedState/ /Users/<user>/Library/Caches/Metadata/Safari/Bookmarks/ /Users/<user>/Library/Caches/Metadata/Safari/History/

/Users/<user>/Library/Caches/com.apple.Mail/Cache.db /Users/<user>/Library/Mail/V2/Mailboxes/ /Users/<user>/Library/Mail/V2/IMAP-<name@address> /Users/<user>/Library/Mail/V2/POP-<name@address>

/Users/<user>/Library/Mail/V2/MailData/BackupTOC.plist /Users/<user>/Library/Mail/V2/MailData/Envelope Index /Users/<user>/Library/Mail/V2/MailData/OpenedAttachments.plist /Users/<user>/Library/Mail/V2/MailData/SearchHistory.plist /Users/<user>/Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plist /Users/<user>/Library/Mail/V2/MailData/SmartMailboxes.plist /Users/<user>/Library/Mail/V2/RSS/ /Users/<user>/Library/Mail Downloads/ /Users/<user>/Library/Preferences/com.apple.Mail.plist /Users/<user>/Library/Application Support/Address Book/MailRecents-v4.abcdmr

/Users/<user>/Library/Preferences/com.apple.iChat.plist /Users/<user>/Documents/iChats/ /Users/<user>/Library/Caches/com.apple.iChat/Pictures /Users/<user>/Library/Images/iChat Recent Pictures/

/Users/<user>/Pictures/iPhoto Library /Users/<user>/Pictures/iPhoto /Library/Originals/ /Users/<user>/Pictures/iPhoto /Library/Modified/ /Users/<user>/Pictures/iPhoto /Library/iPhotoMain.db /Users/<user>/Pictures/iPhoto /Library/iPod Photo Cache/ /Users/<user>/Pictures/iPhoto /Library/ /Users/<user>/Pictures/iPhoto /Library/AlbumData.xml /Users/<user>/Pictures/iPhoto /Library/AlbumData2.xml /Users/<user>/Pictures/iPhoto /Library/iPhoto.ipspot /Users/<user>/Library/Preferences/com.apple.iPhoto.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.iPhoto.plist

/Users/<user>/Library/Preferences/com.apple.iTunes.plist /Users/<user>/Music/iTunes/ /Users/<user>/Music/iTunes/iTunes Media/ /Users/<user>/Music/iTunes/iTunes Music Library.xml

/Users/<user>/Pictures/Photo Booth /Library/Recents.plist /Users/<user>/Pictures/Photo Booth /Library/Pictures/ /Users/<user>/Library/Caches/com.apple.PhotoBooth/

/Users/<user>/Library/Preferences/com.apple.PhotoBooth.plist

/Users/<user>/Library/Application Support/Address Book/AddressBook-v22.abcddb /Users/<user>/Library/Preferences/com.apple.AddressBook.abd.plist /Users/<user>/Library/Preferences/com.apple.AddressBook.plist

/Users/<user>/.Spotlight-V100/ /Users/<user>/.Spotlight-V100/Store-V<#>/<GUID>/shutdown_time

/Users/<user>/Library/PubSub/Database/Database.sqlite3 /Users/<user>/Library/PubSub/Clients.plist /Users/<user>/Library/PubSub/Feeds/ /Users/<user>/Library/Mail/V2/RSS/

/Users/<user>/Library/Saved Application State/ /Users/<user>/Library/Saved Application State/<application.savedState>/Windows.plist

/Users/<user>/Library/Preferences/ /Users/<user>/Library/Preferences/.GlobalPreferences.plist /Users/<user>/Library/Preferences/com.apple.photobooth.plist /Users/<user>/Library/Preferences/com.microsoft.office.plist /Users/<user>/Library/Preferences/com.apple.Calculator.plist /Users/<user>/Library/Preferences/com.apple.Dashboard.plist /Users/<user>/Library/Preferences/com.apple.Desktop.plist /Users/<user>/Library/Preferences/com.apple.DiskUtility.plist /Users/<user>/Library/Preferences/com.apple.Dock.plist /Users/<user>/Library/Preferences/com.apple.Finder.plist /Users/<user>/Library/Preferences/com.apple.iCal.plist /Users/<user>/Library/Preferences/com.iChat.plist /Users/<user>/Library/Preferences/com.apple.iMovie8.plist /Users/<user>/Library/Preferences/com.apple.iPhoto.plist /Users/<user>/Library/Preferences/com.apple.iWeb.plist /Users/<user>/Library/Preferences/com.apple.iTunes.plist /Users/<user>/Library/Preferences/com.OnyX.plist /Users/<user>/Library/Preferences/org.kismac-ng.kismac.plist /Users/<user>/Library/Preferences/net.irradiated.Black-Hole.plist /Users/<user>/Library/Preferences/com.aol.aim.desktop.plist /Users/<user>/Library/Preferences/com.apple.keychainaccess.plist /Users/<user>/Library/Preferences/com.apple.AddressBook.plist /Users/<user>/Library/Preferences/com.apple.iApps.plist

/Users/<user>/Preferences/com.apple.sidebarlists.plist

/Users/<user>/Library/Preferences/loginwindow.plist /Users/<user>/Library/Preferences/com.apple.loginitems.plist /Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/StartupItems/ /System/Library/LaunchDaemons/ /System/Library/StartupItems/

/Users/<user>/Library/Preferences/com.apple.Preview.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.PropertyListEditor.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.QuickTimePlayerX.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.recentitems.plist /Users/<user>/Library/Preferences/com.apple.ScreenSharing.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.TextEdit.LSSharedFileList.plist /Users/<user>/Library/Preferences/org.videolan.vlc.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.Grab.LSSharedFileList.plist /Users/<user>/Library/Preferences/com.apple.Console.LSSharedFileList.plist

/Users/<user>/Library/Logs/ /var/log/ /Library/Logs/ /Users/<user>/Library/Preferences/com.apple.Dock.db /Users/<user>/Library/Preferences/com.apple.iPod.plist /Users/<user>/Library/Preferences/com.apple.LaunchServices.QuarantineEvents /Users/<user>/.bash_history /Users/<user>/Library/Preferences/AddressBookMe.plist /Users/<user>/Library/Application Support/ /Users/<user>/Library/Keychains/ /Users/<user>/.Trash/ /System/Library/CoreServices/SystemVersion.plist /private/var/db/.AppleSetupDone /Volumes/MobileBackups/ /Users/<user>/Preferences/Macromedia/Flash Player/#SharedObjects/ /Users/<user>/Preferences/Macromedia/Flash Player/support/flash player/sys/ /Users/<user>/Preferences/CD Info.cidb /Library/Preferences/com.apple.loginwindow.plist /Library/Preferences/com.apple.Bluetooth.plist /Library/Preferences/com.apple.SoftwareUpdate.plist /Library/Preferences/com.apple.TimeMachine.plist /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist /Users/<user>/.DocumentRevisions-V100/ /var/vm/sleepimage

/var/vm/swapfile# /var/db/dslocal/nodes/Default/users/

/Users/<user>/Library/Application Support/Firefox/ /Users/<user>/Library/Application Support/Firefox/Profiles/ /Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Cookies.sqlite /Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Downloads.sqlite /Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Formhistory.sqlite /Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Places.sqlite

/Users/<user>/Library/Application Support/Google/Chrome/ /Users/<user>/Library/Caches/com.google.Chrome/ /Users/<user>/Library/Preferences/com.google.Chrome.plist /Users/<user>/Library/Preferences/com.google.Chrome.helper.plist /Users/<user>/Library/Preferences/com.google.Keystone.Agent.plist

/Users/<user>/.tor /Users/<user>/.tor/State

/Users/<user>/Library/VirtualBox/ /Users/<user>/Library/VirtualBox/VirtualBox.xml /Users/<user>/Library/VirtualBox/VBoxSVC.log /Users/<user>/Library/Caches/org.virtualbox.app.VirtualBox/ /Users/<user>/VirtualBox VMs/

/Users/<user>/Dropbox /Users/<user>/Library/Caches/com.getdropbox.dropbox /Users/<user>/.dropbox/ /Users/<user>/.dropbox/Config.db /Users/<user>/.dropbox/filecache.db

/Users/<user>/Library/Application Support/Skype/ /Users/<user>/Library/Application Support/Skype/<Skype user name>/ /Users/<user>/Library/Preferences/com.skype.skype.plist /Users/<user>/Library/Application Support/Skype/<Skype user name>/Main.db /Users/<user>/Library/Application Support/Skype/<Skype user name>/chatsync/

/Users/<user>/Library/Application Support/Handbrake/ /Users/<user>/Library/Application Support/Handbrake/EncodeLogs/ /Users/<user>/Library/Application Support/Handbrake/HandBrake-activitylog.txt /Users/<user>/Library/Application Support/Handbrake/Queue.plist /Users/<user>/Library/Application Support/Handbrake/Previews/ /Users/<user>/Library/Preferences/org.m0k.handbrake.plist

/etc/hosts /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

/Users/<user>/Library/Preferences/com.twitter.twitter-mac.plist /Applications/Twitter.app/ /Users/<user>/Library/Caches/com.twitter.twitter-mac /Users/<user>/Library/Caches/com.twitter.twitter-mac/Cache.db /Users/<user>/Library/Saved Application State/com.twitter.twitter-mac.savedState

/Users/<user>/Library/iCloud/Accounts/

/Users/<user>/Library/Application Support/Adium 2.0/Users/Default/Logs/

/Users/<user>/Library/Preferences/com.macpaw.CleanMyMac.plist

/Users/<user>/Library/Application Support/Evernote/ /Users/<user>/Library/Application Support/Evernote/data/ /Users/<user>/Library/Application Support/Evernote/logs/ /Users/<user>/Library/Application Support/Evernote/data/<profile>/Evernote.sql /Users/<user>/Library/Application Support/Evernote/data/<profile>/Content/

/private/etc/hostconfig /private/etc/ntp.conf /private/var/run/ntp.drift

/Library/Logs/DirectoryService/DirectoryService.server.log /private/var/log/asl.log

https://docs.google.com/spreadsheet/ccc?key=0AkBdGlxJhWNotes

Hidden directory in Lion

Not user-specific

Plist listing default and user-added Safari bookmarks Plist listing files downloaded using Safari Browser Plist describing installed Safari Extensions Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension. Plist listing Safari web browsing history An index of Safari History allowing a user to perform keyword searches of visited webpages A plist describing the state of Safari when it was last closed A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .localstorage. A database listing the webpage specific databases Will persist in directory after desktop picture has been changed to something else A Plist listing the webpages belonging to a Safari's Top Sites A database containing saved web page icons for webpages visited A directory for webpage-specific database storage A database that keeps track of stored webpage-specific databases A directory containing Safari-specific cache items A cache of data from visited webpages A directory containing cached items for Safari Extensions A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage URL. A Plist containing cookies from visited webpages Contains recent safari search strings and downloads folder location in addition to preferences

Each bookmark entry in Bookmarks.plist is stored as an individual file in this directory for more efficient use with Spotlight and to all Each website entry in History.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow the

Cached images from email messages Apple Mail Mailboxs Synched IMAP Account(s) Synched POP Account(s)

Backup Plist that defines the mailbox structure Keeps track of the location of Mail messages - the content of some messages is present as well Plist listing opened Mail attachments Plist listing search terms entered into Mail's search box Plist containing Mail signatures Smart Mailbox information Directory containing RSS feed mailboxes Directory containing files downloaded from email messages Mail preferences SQLite database stored in Address Book's support directory containing recent Mail contacts

iChat preferences and user account information User iChat icon Recent user iChat pictures

Specialized folder that contains user's iPhoto pictures Contains original versions of all photos Contains modified versions of photos Contains detailed information about iPhoto library Directory of folders containing .ithmb photos synced to iDevice. Folder modified date/time stamp updated upon sync. SQLite databases containing data about recognized faces Plist containing information about some iPhoto albums/events and path/photo ID info for each picture in the library Plist containing information about some iPhoto albums/events and other iPhoto information iPhoto Recent Items - typically only contains iPhoto Library package iPhoto preferences

iTunes preferences iTunes library directory Directory containing iTunes media files XML file defining the iTunes music library

A Plist listing the recent photos and videos taken using Photo Booth. Items deleted by the user will not be saved to this list. A directory containing the user's Photo Booth pictures Photo Booth cache directory

Photo Booth preferences

SQLite database containing contact information Address Book preferences

Spotlight directory containing text indexes Last shutdown time stored as a Unix 32-bit hex value in Little Endian

SQLite database containing RSS Feed information Plist containing RSS Feed information

A directory containing folders pertaining to the saved state of OS X applications A property list describing the state of the windows during the applications last use

Directory containing user preference settings for applications and utilities Global Preferences Plist Photo Booth preferences Office preferences and recent items Contains recent conversions Dashboard preferences including installed widgets Desktop preferences including current Desktop background picture Disk Utility preferences including recent disk images Dock preferences including persistent apps and directories Finder preferences including mounted volumes iCal preferences iChat accounts, preferences, away messages, recent chats, etc. iMovie preferences and recent items iPhoto preferences iWeb preferences iTunes preferences OnyX preferences KisMAC preferences Black Hole System Cleaner Preferences & Last launch time AIM preferences & account info Keychain preferences including last accessed Keychain Address Book preferences Plist listing the paths of iApp (iTunes, iPhoto, etc.) databases

Lists the names of volumes mounted on the desktop that have appeared in the sidebar list

Plist containing applications that are launched when the user logs in Plists listing applications that automatically start when the user is logged in

Preview recent items Property list Editor recent items QuickTime recent items Recently opened applications, files, and servers Recent screen shares TextEdit recent items VLC recent items Screenshots recently taken and saved with Grab Recent logs viewed with Console

Directory containing numerous log files

Database containing directories, files, and apps that have appeared in the Dock Attached iDevices SQLite database that keeps track of files that have the quarantine extended attribute that is given to applications, scripts, and execu Terminal commands history Plist containing user information such as name, address, phone number, etc. Contains application-specific folders used to support applications and utilities Directory containing user keychain files User Trash directory Plist describing the installed Operating System Plist listing the information entered by the user at the time of the OS setup Local Time Machine backup directory stored on disk. Time Machine backups are created and stored here when Time Machine back Contains Flash shared object artifacts that identify webpages visited Contains Flash player support artifacts that identify webpages visited A database file used to "remember" CD's (user-created & store bought). Also, the file gets updated if a user manually enters track n Plist containing password hints and last user logged in Bluetooth preferences and paired devices Plist describing last attempt and last successful attempt at updating OS X software Time Machine backup info Remembered wireless networks Directory containing automatically saved versions of files Contents of RAM are written to this file when the computer is put to sleep

Numerous swap files may be found in this directory with the naming convention of swapfile# (swapfile0, swapfile1, Contains the salted SHA-512 hash value for the user's log in password http://www.defenceindepth.net/2011/09/cracking-os-x-lion-passwords.html

Directory containing user artifacts for Mozilla Firefox web browser

Text entered into forms including search terms, email addresses, and login information.

Directory containing user artifacts for Google Chrome web browser Google Chrome cache directory

Text fie describing the version of Tor used and the last time it was ran

Directory containing VirtualBox configuration files An XML file describing VirtualBox settings. Contains information about recently run virtual machines. VirtualBox log file VirtualBox cache directory Directory for VirtualBox virtual machines

Drop Box cache directory Hidden configuration folder for Drop Box SQLite database containing configuration information, such as Drop Box directory path and user email account. SQLite database containing information about files stored in Drop Box directory.

Directory containing Skype user artifacts Directory containing Skype user artifacts Skype preferences and recent user searches Database of contacts, SMS's, calls, conversations, videos, messages, etc. Directory containing chat logs

Directory for Handbrake DVD ripper Log files for each rip Activity log HandBrake queue Contains previews of unfinished rips Handbrake preferences & last launch time

Remembered wireless networks

Twitter application folder Twitter cache directory SQLite database file containing cached Twitter feed data Twitter saved application state directory

directory containing Adium chat transcripts

Contains user profiles and Evernote user data

Evernote profile info - contains various information about the user's Evernote account such as last sync, titles of Evernote entries, u Contains the content of the user's Evernote data. Content stored as HTML, XML, graphics, and various other non-proprietary file typ

he file extension of .localstorage.

ash of the webpage URL.

fficient use with Spotlight and to allow the user to select the bookmark entry from Spotlight and have Safari launch the corresponding webpage use with Spotlight and to allow the user to select the webpage entry from Spotlight and have Safari launch the corresponding webpage

will not be saved to this list.

n to applications, scripts, and executables downloaded from potentially untrustworthy locations/people. The SQLite database contains URLS, email addre

ored here when Time Machine backup disk is not available.

ed if a user manually enters track names in iTunes.

st sync, titles of Evernote entries, urls, owner info, lat/long coords, etc. various other non-proprietary file types.

e Safari launch the corresponding webpage launch the corresponding webpage

le. The SQLite database contains URLS, email addresses, email subjects, and other potentially useful information.