BlackSquirrelz 👾<p>Some macOS Forensics</p><p>macOS 12:</p><p>In `/System/Volumes/Data/Users/<USER>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist` <br>You can find a key, which is intially not set. But will be set if the user deleted the browser history.</p><p>I saved the plist to a regular textfile before and after clearing the browser history. And compared the two with:</p><p>`diff prefernces.before.change.txt preferences.after.change.txt`</p><p>"ClearBrowsingDataLastIntervalUsed" => "all history"</p><p>This is an interesting key, unfortunately I was only able to find this in macOS 12.</p><p>Did someone else notice that key?</p><p><a href="https://infosec.exchange/tags/macos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>macos</span></a> <a href="https://infosec.exchange/tags/forensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>forensics</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/macos12" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>macos12</span></a> <a href="https://infosec.exchange/tags/apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>apple</span></a></p>