Keyboard Dictionary
Overview
Section titled “Overview”Evidence: Keyboard Dictionary
Description: Collects the list of words in the keyboard dictionary
Category: System
Platform: macos
Short Name: keydict
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Keyboard dictionary entries contain user-added words for autocorrect. This data is essential for profiling user terminology and contextualizing typed content.
Data Collected
Section titled “Data Collected”This collector gathers structured data about keyboard dictionary.
Collection Method
Section titled “Collection Method”This collector reads each user’s LocalDictionary file and records entries into keyboard_dictionary.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it can indicate custom vocabulary relevant to the case and user behavior.