search

jipegit / OSXAuditor

OS X Auditor is a free Mac OS X computer forensics tool
Other
3.13k stars 280 forks source link

Fix 10.9 Wireless Preference Parsing #8

Closed sroberts closed 10 years ago

sroberts commented 10 years ago

I was having issues running OSXAuditor under Mavricks. After taking a look through the Plist I realized that the /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file format has changed.

I added a more robust OSX version detection based on the current GetAuditedSystemVersion method. This made it easer to create different parsing based on the different plist versions. I think this makes it more robust for future usage on 10.9.

sroberts commented 10 years ago

I'm missing more than a few different pieces of code. Unfortunately the LastConnected & SystemMode both seem to be optional, or at least not present in all of the dictionaries in the plist. I need to add something to check and see if LastConnected exists and print it conditionally, since that one is super useful from a forensic perspective.

sroberts commented 10 years ago

Superseded by #11.