Logo
RSS Feed

macOS

Created: 28.07.2022

/Users/username/.zsh_history look for something like hdiutil mount silenteye-0.4.1b-snowleopard.dmg and sudo cp -R /Volumes/SilentEye/silenteye-0.4.1b-snowleopard_installer.app /Applications.

Also, /Users/sneaky/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts if it was then searched via Spotlight.

plutil -p "/Users/sneaky/Library/Preferences/com.apple.dock.plist" . Also gives some information on the file location, timestamps and bundle id.

1 => {

      "GUID" => 2221790314
      "tile-data" => {
        "book" => {length = 592, bytes = 0x626f6f6b 50020000 00000410 30000000 ... 04000000 00000000 }
        "bundle-identifier" => "com.bitrock.installbuilder"
        "dock-extra" => 0
        "file-data" => {
          "_CFURLString" => "file:///Applications/silenteye-0.4.1b-snowleopard_installer.app/"
          "_CFURLStringType" => 15
        }
        "file-label" => "silenteye-0.4.1b-snowleopard_installer"
        "file-mod-date" => 187534827240406
        "file-type" => 1
        "parent-mod-date" => 187380208417750
      }
      "tile-type" => "file-tile"
    }

🗒 TODO: Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.spotlight/appList.dat matches Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.FavoriteVolumes.sfl2 matches Binary file ./0/root/Users/sneaky/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.RecentApplications.sfl2 matches

References

Expand… Something here