Skip to content

INSTALLHISTORY

Yogesh Khatri (@swiftforensics) edited this page May 17, 2018 · 3 revisions

The INSTALLHISTORY plugin parses the /Library/Receipts/InstallHistory.plist file to get information about programs that have been installed.

This plugin supports standalone mode.

Sample Usage

$ python mac-apt.py -x -o ~/Case_Output ~/Acquisition.E01 INSTALLHISTORY

Output

Field Name Notes
ContentType -
Date -
DisplayName -
DisplayVersion -
PackageIdentifiers -
ProcessName -

Getting Started

Plugins

Development

  • Write a Plugin
  • Plugin Helpers
Clone this wiki locally