This repository has been archived by the owner on Oct 5, 2019. It is now read-only.

Consider including /var/db/receipts directory in osxcollector outptut #96

Open

ivanlei opened this issue Jul 6, 2015 · 1 comment

Labels

ready

ivanlei commented Jul 6, 2015

There is some pretty cool information in /var/db/receipts. Perhaps this would be useful in our malware investigations.

Use lsbom and plutil -convert xml1 to read the contents of the packages that were installed.

Contributor

jjsendor commented Dec 22, 2015

Some more info regarding what is inside the receipts: http://www.nickshubin.com/articles/mac/install_history.html

jjsendor added the ready label

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.