MacMRU Plist Parser

Sarah Edwards has written a fresh Mac forensics script. The script could be used for parsing both new SFL-based MRU plist files found in OS X 10.11 and ‘older’ format plist files used in OS X 10.10 and older.

This script parses the following plist files:

• /Users/<username>/Library/Preferences/<bundle_id>.LSShardFileList.plist
• /Users/<username>/Library/Preferences/com.apple.finder.plist
•  [10.10-] /Users/<username>/Library/Preferences/com.apple.recentitems.plist
• [10.11+] /Users/<username>/Library/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/<bundle_id>.sfl
• [10.11+] /Users/<username>/Library/Library/Application Support/com.apple.sharedfilelist/RecentApplications.sfl
•  [10.11+] /Users/<username>/Library/Library/Application Support/com.apple.sharedfilelist/RecentDocuments.sfl
•  [10.11+] /Users/<username>/Library/Library/Application Support/com.apple.sharedfilelist/RecentServers.sfl
•  [10.11+] /Users/<username>/Library/Library/Application Support/com.apple.sharedfilelist/RecentHosts.sfl

More info about the script you can get at Sarah’s blog.

You can download the script from GitHub.