Join Us!

Notifications
Clear all

Links to Files  

  RSS
noahb2868
(@noahb2868)
Member

I was wondering if there are such a thing as link files in the MAC OS? If so, where would these be located?

Thanks…..

Quote
Posted : 16/06/2010 10:41 pm
JSkier
(@jskier)
New Member

I assume you mean like in Windows with lnk files for shortcuts? In OS X one can create an alias (as they call it) to a file or location; these will not have extensions but will contain data as to where they are pointing to. Control+L allows an alias to be created, and the "link file" goes wherever the user desires it. I'm not a very savvy OS X forensic person, but you should be able to search for alias file types with some of the Mac forensic tools I'd imagine.

ReplyQuote
Posted : 16/06/2010 11:40 pm
mjantal
(@mjantal)
Junior Member

What you are probably looking for are the various apple property list (plist) files. There are many plists, but some that you may be particularly interested in are user domain plists; com.apple.recentitems.plist (recently accessed apps and files), com.apple.TextEdit.plist (recently accessed max text files), com.apple.print.custompresets.plist (recent print activity including user/filename). There are also local domain and system domain plist files that can be helpful but are more analogous to windows registry keys

ReplyQuote
Posted : 17/06/2010 12:13 am
Share: