Dock Items
Overview
Section titled “Overview”Evidence: Dock Items
Description: Collect Dock Items
Category: System
Platform: macos
Short Name: dckitms
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Dock preferences record persistent apps, folders, and recent items displayed in the macOS Dock. This data is essential for understanding user activity and potential persistence via Dock items.
Data Collected
Section titled “Data Collected”This collector gathers structured data about dock items.
Dock Items Data
Section titled “Dock Items Data”| Field | Description | Example |
|---|---|---|
GUID | GUID | 123 |
User | User | Example value |
FileLabel | File Label | Example value |
ParentModified | Parent Modified | 2023-10-15 14:30:25+03:00 |
FileModified | File Modified | 2023-10-15 14:30:25+03:00 |
RecentlyUsed | Recently Used | true |
FileType | File Type | 123 |
FileTypeName | File Type Name | Example value |
FilePath | File Path | Example value |
Source | Source | Example value |
Collection Method
Section titled “Collection Method”This collector reads users’ com.apple.dock.plist files, decodes entries, and records items into the dock_items table.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals recently used and pinned applications, supporting timeline and behavior analysis.