Apple Plist

/Library/Receipts/InstallHistory.plist

/Users/%username%/Library/Preferences/com.apple.finder.plist

plutil -p "./0/root/private/var/db/dslocal/nodes/Default/sharepoints/Super Sneaky’s Public Folder.plist"

`/Users/username/.zsh_history` look for something like `hdiutil mount silenteye-0.4.1b-snowleopard.dmg` and `sudo cp -R /Volumes/SilentEye/silenteye-0.4.1b-snowleopard_installer.app /Applications`. 

Also, `/Users/sneaky/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts` if it was then searched via Spotlight.

`plutil -p "/Users/sneaky/Library/Preferences/com.apple.dock.plist"` . Also gives some information on the file location, timestamps and bundle id.

```bash
1 => {

      "GUID" => 2221790314
      "tile-data" => {
        "book" => {length = 592, bytes = 0x626f6f6b 50020000 00000410 30000000 ... 04000000 00000000 }
        "bundle-identifier" => "com.bitrock.installbuilder"
        "dock-extra" => 0
        "file-data" => {
          "_CFURLString" => "file:///Applications/silenteye-0.4.1b-snowleopard_installer.app/"
          "_CFURLStringType" => 15
        }
        "file-label" => "silenteye-0.4.1b-snowleopard_installer"
        "file-mod-date" => 187534827240406
        "file-type" => 1
        "parent-mod-date" => 187380208417750
      }
      "tile-type" => "file-tile"
    }