Running head: EXAMINE PLIST FILES 1

Examine Plist Files

Lorenze Salas

Professor Keith Swanson

EXAMINE PLIST FILES 2

Examine Plist Files

What is a PLIST files? PLIST, also known as Property List, is an application extension

that saves preferences in the macOS. Those files usually contain configuration within various

programs, including XML files. Kevin Arrows mentions that “It is the default format for

preference files but also used for holding application arguments for launching daemons and

resource management in application bundles” (Arrows, 2021).

To examine the PLIST files from the Mac folder in the file system, I used AccessData

FTK Imager to use this examination. I used my physical drive as my main evidence of this

assignment, then went to find the Mac folder on the partitions 3 list. After finding the Mac folder,

I opened each of the files until I find a list of PLIST files. When gathering enough information,

there are 10 PLIST files that is scattered throughout the folder.

EXAMINE PLIST FILES 3

PLIST Files Viewer Panel Descriptions Screenshots

(Preference) It shows information of password

Passcode Lock lock. Not enough information to know

what the passcode is.

(Mail) Accounts It shows some information about the

account. It appears to be

wtg@aol.com as their email.

EXAMINE PLIST FILES 4

(Maps) History An interesting piece of information. It

includes a street address of the

location – involving latitude and

longitude.
EXAMINE PLIST FILES 5

(Maps) Route It shows the route starting and ending

string. It doesn’t give a specific

location to start with.

Network Identification A list of IPv4 sever address, address,

DNS, Subnet Masks, etc.

Wifi A network setting that shows a list of

known networks within the device.

EXAMINE PLIST FILES 6

Network An interface that gives BSD Name,

Interfaces IOBuiltIn, Mac Address, Path Match,

etc.

Bookmarks It displays a Safari bookmark, appears to

have one website URL link. Not enough

detailed information.

History and It displays the web searches that were

SuspendState found in the Safari web browser.

EXAMINE PLIST FILES 7

References

Arrows, K. (2021, July 22). What are PLIST files and is it safe to delete

them? Appuals.com. https://appuals.com/what-are-plist-files-and-is-it-safe-to-delete-

them/.