Notifications
Clear all

Apple Mac & Microsoft App Help

5 Posts
4 Users
0 Likes
288 Views
(@englishgit)
Posts: 22
Eminent Member
Topic starter
 

I am doing an examination of apple macs with Microsoft Office installed on them (version 11.3). I need to find the name of the user stored by Microsoft Word, as it appears it will correlate with the user of the computer. The author of several documents is the same name but different layout to the OSX username. Can anyone point me in the right direction?

I'm assuming I'm looking for a plist, but I can't find one in any obvious locations that hold the name I'm looking for. Having said that, my knowledge of OSX isn't brilliant.

Any thoughts or ideas would be greatly appreciated.

 
Posted : 14/01/2008 8:53 pm
(@computerforensics911)
Posts: 16
Active Member
 

Hope This Might Help

Recently Accessed Items In Mac OS X

http//www.macforensicslab.com/ProductsAndServices/index.php?main_page=document_general_info&cPath=5_20&products_id=48&zenid=acd40115ca34aa4e2c4e9582bf675ddf

Showing applications, documents, and severs a user most recently accessed can help direct an investigator to files of interest or help show intent. By default, Mac OS X keeps track of the last 10 applications, documents, and servers used. The user can increase of decrease this number but most leave it set to the default state.

Explore the following file /Library/Preferences/com.apple.recentitems.plist Inside this file you will find recent applications, documents, and servers accessed on the suspect computer. The lists includes applications and documents on local and network drives and include the user that accessed the file (sometimes the user is different if it was accessed on remote server). It also shows PC shared files accessed through a Workgroup and the access path used to open the files. Some of the file pathnames could be the most forensically useful as well as applications used and documents opened.

 
Posted : 14/01/2008 11:15 pm
(@macsrock)
Posts: 2
New Member
 

You can find that info in the following plist

~\Library\Preferences\Microsoft\com.microsoft.Office.prefs.plist

You will need to translate the data to an ascii string. When I do my Macs, I always do them on another Mac. If you have one, download PlistEdit Pro, open the plist, click on the Userinfo\UserIinitials & Userinfo\UserName lines and then change the data view to ascii string and it will show you the name in plain text.

A good forensics class is taught by Phoenix Data Group. It goes in depth on OS X. I believe that they are having a class in Zürich and possibly London. The link is below.

Mac Forensics Survival Course

Dave

 
Posted : 15/01/2008 3:32 am
(@englishgit)
Posts: 22
Eminent Member
Topic starter
 

I was able to translate the above plist file using a virtual machine of Mac OSX and PlistEditPro. Thanks for the assistance. It was a great help.

 
Posted : 12/02/2008 7:48 pm
E5Pro
(@e5pro)
Posts: 69
Trusted Member
 

If you can't get to plist pro (no Mac) just make a copy, rename the extension .plist to .html and drop it on Safari or IE on the windows box, the plist is in XML.

 
Posted : 13/02/2008 1:31 am
Share: