-
Notifications
You must be signed in to change notification settings - Fork 103
INSTALLHISTORY
Yogesh Khatri (@swiftforensics) edited this page May 17, 2018
·
3 revisions
The INSTALLHISTORY plugin parses the /Library/Receipts/InstallHistory.plist file to get information about programs that have been installed.
This plugin supports standalone mode.
$ python mac-apt.py -x -o ~/Case_Output ~/Acquisition.E01 INSTALLHISTORY
Field Name | Notes |
---|---|
ContentType | - |
Date | - |
DisplayName | - |
DisplayVersion | - |
PackageIdentifiers | - |
ProcessName | - |
Getting Started
- Introduction
- Installation
-
Sample Usage
- ios_apt
- Artifact Only Mode
- Mounted System Data Mode
- Interpreting Output
- Issues & Workarounds
Plugins
- AUTOSTART
- BASICINFO
- BLUETOOTH
- DOMAINS
- FSEVENTS
- IDEVICEBACKUPS
- IDEVICEINFO
- IMESSAGE
- INETACCOUNTS
- INSTALLHISTORY
- MSOFFICE
- NETUSAGE
- NETWORKING
- NOTES
- NOTIFICATIONS
- PRINTJOBS
- QUARANTINE
- RECENTITEMS
- SAFARI
- SCREENTIME
- SPOTLIGHT
- SPOTLIGHTSHORTCUTS
- TERMINALSTATE
- TERMSESSIONS
- UNIFIEDLOGS
- USERS
- WIFI
Development
- Write a Plugin
- Plugin Helpers