Added Mac OS artifact definitions (ForensicArtifacts#572)

joachimmetz · Aug 9, 2023 · fd850d9 · fd850d9
1 parent 55a107b
commit fd850d9
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 4 deletions.
diff --git a/data/macos.yaml b/data/macos.yaml
@@ -14,16 +14,14 @@ name: MacOSApplePushServiceSQLiteDatabaseFile
 doc: Apple push service SQLite database file.
 sources:
 - type: FILE
-  attributes:
-    paths: ['/Library/Application Support/ApplePushService/aps.db']
+  attributes: {paths: ['/Library/Application Support/ApplePushService/aps.db']}
 supported_os: [Darwin]
 ---
 name: MacOSAssetCacheInfoSQLiteDatabaseFile
 doc: Asset cache information SQLite database file.
 sources:
 - type: FILE
-  attributes:
-    paths: ['/Library/Caches/com.apple.AssetCache/AssetInfo.db']
+  attributes: {paths: ['/Library/Caches/com.apple.AssetCache/AssetInfo.db']}
 supported_os: [Darwin]
 ---
 name: MacOSAirportPreferencesPlistFile
@@ -444,6 +442,13 @@ sources:
 supported_os: [Darwin]
 urls: ['https://forensics.wiki/mac_os_x_10.9_artifacts_location#mail']
 ---
+name: MacOSMessageChatSQLiteDatabaseFile
+doc: iMessage chat SQLite database file.
+sources:
+- type: FILE
+  attributes: {paths: ['%%users.homedir%%/Library/Messages/chat.db']}
+supported_os: [Darwin]
+---
 name: MacOSMountedDMGs
 doc: MacOS Mounted DMG files.
 sources:

diff --git a/data/webbrowser.yaml b/data/webbrowser.yaml
@@ -1399,3 +1399,21 @@ sources:
     - '%%users.homedir%%/Library/Safari/PerSitePreferences.db-wal'
 supported_os: [Darwin]
 urls: ['https://forensics.wiki/apple_safari']
+---
+name: SafariTouchIconCacheSettingsSQLiteDatabaseFile
+doc: Safari browser touch icon cache settings SQLite database file.
+sources:
+- type: FILE
+  attributes:
+    paths:
+    - '%%users.homedir%%/Library/Safari/Touch Icons Cache/TouchIconCacheSettings.db'
+    - '%%users.homedir%%/Library/Safari/Touch Icons Cache/TouchIconCacheSettings.db-wal'
+supported_os: [Darwin]
+urls: ['https://forensics.wiki/apple_safari']
+---
+name: WebKitPubSubSQLiteDatabaseFile
+doc: WebKit RSS feed (PubSub) SQLite database file.
+sources:
+- type: FILE
+  attributes: {paths: ['%%users.homedir%%/Library/PubSub/Database/Database.sqlite3']}
+supported_os: [Darwin]