INSTALLHISTORY
The INSTALLHISTORY plugin parses the /Library/Receipts/InstallHistory.plist file to get information about programs that have been installed.
This plugin supports standalone mode.
$ python mac-apt.py -x -o ~/Case_Output ~/Acquisition.E01 INSTALLHISTORY
| Field Name | Notes |
|---|---|
| ContentType | Content Type (if listed) of install. If no "Content Type" is listed, ContentType is "None" |
| Date | Date/Time of install |
| DisplayName | Displayed name of install |
| DisplayVersion | Current version of install |
| PackageIdentifiers | List of package identifiers |
| ProcessName | Name of the Process OS X Installer : update/installation of OS softwareupdated : the App Store’s updater storedownloadd : App Store Installer : the Installer app |
| Source | Source file for install information |