This script searches specified items for binary plist files. It was designed primarily to recover such files from unallocated clusters.

Output is via bookmarks and a logical evidence file (LEF). The LEF can be brought-back into EnCase and its contents examined using the Plist Parser or Plist Viewer EnScripts. It may also be possible to process the LEF in order to recover MacOS related artifacts such as Safari Internet history and bookmarks.

The script works by using a basic search-term to locate deleted plists in each of the records/entries it has been told to search.

Before each entry/item is searched its path will be written to the console. The search will then be performed and the status-bar updated to reflect the progress that's been made. At the conclusion of each search, the script will write the number of hits that have been found, reset the status bar and then attempt to verify each hit. The status bar will then be used to represent the progress of the hit-validation process.

The examiner should expect to find many thousands of hits particularly when searching the unallocated clusters of a MacOS system volume. Once the script has finished processing, the examiner can use a raw keyword search to identify plist files of particular note.

The script provides the option to de-duplicate the plist files that it finds. Also, to skip plist files embedded in other plist files. The script accomplishes the latter by processing hits in reverse order. The examiner may need to bear this in mind when reviewing the hits that have been bookmarked.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training