Printer Info
Overview
Section titled “Overview”Evidence: Printer Info
Description: Collect printer info
Category: System
Platform: macos
Short Name: prnt
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”CUPS destinations and options describe configured printers on macOS. This data is essential for understanding printing infrastructure and potential exfiltration channels.
Data Collected
Section titled “Data Collected”This collector gathers structured data about printer info.
Printer Info Data
Section titled “Printer Info Data”| Field | Description | Example |
|---|---|---|
Name | Name | Example value |
OptionName | Option Name | Example value |
OptionValue | Option Value | Example value |
Collection Method
Section titled “Collection Method”This collector queries the cups_destinations table via osquery and records results into printer_info.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it identifies available printers and configurations relevant to data leakage scenarios.