/Users/username/.zsh_history look for something like hdiutil mount silenteye-0.4.1b-snowleopard.dmg and sudo cp -R /Volumes/SilentEye/silenteye-0.4.1b-snowleopard_installer.app /Applications.
Also, /Users/sneaky/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts if it was then searched via Spotlight.
plutil -p "/Users/sneaky/Library/Preferences/com.apple.dock.plist" . Also gives some information on the file location, timestamps and bundle id.
1 => {
"GUID" => 2221790314
"tile-data" => {
"book" => {length = 592, bytes = 0x626f6f6b 50020000 00000410 30000000 ... 04000000 00000000 }
"bundle-identifier" => "com.bitrock.installbuilder"
"dock-extra" => 0
"file-data" => {
"_CFURLString" => "file:///Applications/silenteye-0.4.1b-snowleopard_installer.app/"
"_CFURLStringType" => 15
}
"file-label" => "silenteye-0.4.1b-snowleopard_installer"
"file-mod-date" => 187534827240406
"file-type" => 1
"parent-mod-date" => 187380208417750
}
"tile-type" => "file-tile"
}
🗒 TODO: Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.spotlight/appList.dat matches Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.FavoriteVolumes.sfl2 matches Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.RecentApplications.sfl2 matches