mac accounts.AppleShare: A list of login and password details for appleshare servers this mac has connected to.įolder Dates: A list of all the key user folders along with their creation date, date of last modification, date of first access, and date of the most recent access.Disk Images: Paths to the most recent disk images that have been mounted on this mac.Preview: Full paths to recent files that have been viewed in the preview program.QuickTime: File names for recently viewed movies for the QuickTime player applicationsRecent Applications, Documents, and Servers: Program names for the most recently used items on this Macintosh computer.ĭefault Login: For iChat instant messenger system.Complete buddy list: Includes buddies who have since been deleted.Īccount Details: Login names and server addresses used.Address Book: Address details for entries in the address book including contacts that have been deleted. General: Includes (but is not limited to) passwords for encrypted disk images, wifi base stations, iTunes music store, iChat login and Apple Remote Desktop.Internet: Includes (but is not limited to) login and password details for web sites, email accounts, some peer to peer networks, online services and stores, auction sites, and. System: The user password of the logged in user. The following is a list of file items that can be extracted using SubRosaSoft’s MacLockPick:
#MACLOCKPICK MAC OS X#
This database can be read by the included log readers on Microsoft Windows, Linux, or Apple Mac OS X computers back at base. The MacLockPick extracts data from the Apple Keychain and system settings to provide the examiner fast access to the suspect's critical information with as little interaction or trace as possible.Ī database of the suspect’s information is compiled on the Flash Drive to allow for easy transportation away from the suspect's system. These data sources even include items that your suspect may have previously deleted or has migrated from previous Mac OS X computers. It also makes use of the openly readable settings files used to keep track of your suspect's contacts, activities and history. MacLockPick takes advantage of the fact that the default state of the Apple Keychain is open, even if the system has been put to sleep. The “live forensics tool” is based on Flash drive technology and is available only to law enforcement officials - amateur gumshoes will have to tread the mean streets of the internet superhighway without it. But the US$499 device can only penetrate the defences of Macs running OSX – apparently, anyone who manages to build an empire of crime using Windows deserves to keep it. SubRosaSoft’s MacLockPick is a USB sized gizmo that can extract passwords, e-mail addresses, recently accessed files, search strings, bookmarks and internet history from running or sleeping computers.
0 kommentar(er)
