Binary Plist Finder
This script searches specified items for binary plist files. It was designed primarily to recover such files from unallocated clusters.
Output is via bookmarks and a logical evidence file (LEF). The LEF can be brought-back into EnCase and its contents examined using the Plist Parser or Plist Viewer EnScripts. It may also be possible to process the LEF in order to recover Mac OS X related artifacts such as Safari Internet history and bookmarks.
The script works by using a basic search-term to locate deleted plists in each of the records/entries it has been told to search.
Before each entry/item is searched its path will be written to the console. The search will then be performed and the status-bar updated to reflect the progress that's been made. At the conclusion of each search the script will write the number of hits that have been found, reset the status bar and then attempt to verify each hit. The status bar will then be used to represent the progress of the hit-validation process.
The examiner should expect to find many thousands of hits particularly when searching the unallocated clusters of a Mac OS X system volume. Once the script has finished processing, the examiner can use a raw keyword search to identify plist files of particular note.
The script provides the option to de-duplicate the plist files that it finds. It will also skip plist files that it finds in other plist files. Due to the way in which it works, the script accomplishes the latter by processing the hits it finds in each file in reverse order. The examiner might need to bear this in mind when reviewing hits that have been bookmarked.Download Now