MacOS Var-Folders Name Converter
Decodes the UUID and UID from the names of sub-folders under /private/var/folders in MacOS.
This scripts supports the 5-bit encoding method used by Mac OS 10.9 and later.
This encoding-method uses the following character-array, which is 32-characters in length (2^5 = 32):
- 0123456789_bcdfghjklmnpqrstvwxyz
After concatenating the UUID and UID of a folder's owner into a binary string, each 5-bit value in that string is used to index a character in the aforementioned character-array, e.g., 00000 would index the character '0'; 11111 would index the character 'z'.
The first two indexed characters become the name of the folder's parent. The remainder become the name of the folder itself.
Output is via the console window and bookmarks.
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now