Update the known wifi networks parser for MacOS

log2timeline / plaso

Super timeline all the things

https://plaso.readthedocs.io

Apache License 2.0

1.72k stars 348 forks source link

Update the known wifi networks parser for MacOS #4039

Open anttitikkanen opened 2 years ago

anttitikkanen commented 2 years ago

Description of problem:

Since MacOS Big Sur (and later), the known wifi network information has moved from /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist to /Library/Preferences/com.apple.wifi.known-networks.plist.

The plugin could be updated to support this: https://github.com/log2timeline/plaso/blob/main/plaso/parsers/plist_plugins/airport.py

Plaso version:

Latest

Note: I'm happy to contribute this change!

joachimmetz commented 2 years ago

Note: I'm happy to contribute this change!

Thx, much appreciated, I'll assign the issue to you then. Let me know if there are questions about the review / development process.

joachimmetz commented 2 years ago

Observations /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist is still present on Monterey 12.1

/Library/Preferences/com.apple.wifi.known-networks.plist does not appear to be always present