Notifications
Clear all

Links to Files

3 Posts
3 Users
0 Likes
225 Views
noahb2868
(@noahb2868)
Posts: 50
Trusted Member
Topic starter
 

I was wondering if there are such a thing as link files in the MAC OS? If so, where would these be located?

Thanks…..

 
Posted : 16/06/2010 9:41 pm
JSkier
(@jskier)
Posts: 24
Eminent Member
 

I assume you mean like in Windows with lnk files for shortcuts? In OS X one can create an alias (as they call it) to a file or location; these will not have extensions but will contain data as to where they are pointing to. Control+L allows an alias to be created, and the "link file" goes wherever the user desires it. I'm not a very savvy OS X forensic person, but you should be able to search for alias file types with some of the Mac forensic tools I'd imagine.

 
Posted : 16/06/2010 10:40 pm
(@mjantal)
Posts: 49
Eminent Member
 

What you are probably looking for are the various apple property list (plist) files. There are many plists, but some that you may be particularly interested in are user domain plists; com.apple.recentitems.plist (recently accessed apps and files), com.apple.TextEdit.plist (recently accessed max text files), com.apple.print.custompresets.plist (recent print activity including user/filename). There are also local domain and system domain plist files that can be helpful but are more analogous to windows registry keys

 
Posted : 16/06/2010 11:13 pm
Share: