In their last blog post BlackBag Training Team discuss forensic examination of recent files in Mac OS Sierra. The team notes that such files are used to be saved in one plist  – com.apple.recentitems.plist, but now Apple starts to use so called LSShareFileList files for this. You can learn more about these files in their post.

Load More Related Articles
Load More In Tips & Tricks

Leave a Reply

Your email address will not be published. Required fields are marked *