Added MacOS login window plugin

log2timeline / plaso

Super timeline all the things

Apache License 2.0

1.71k stars 334 forks source link

One line description of pull request

Adds a parser for MacOS login window data containing autolaunch applications + login/logout hook scripts.

Description:

Covers data stored in /var/root/Library/Preferences/com.apple.loginwindow.plist. Note this does not cover %%users.homedir%%/Library/Preferences/ByHost/com.apple.loginwindow.*.plist artifacts.

Notes:

All contributions to Plaso undergo code review. This makes sure that the code has appropriate test coverage and conforms to the Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in order, and then a maintainer will review your code.

Checklist:

[x] Automated checks (GitHub Actions, AppVeyor) pass
[x] No new new dependencies are required or l2tdevtools has been updated
[x] Reviewer assigned

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (5884cb8) 86.05% compared to head (b2f5772) 86.06%.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #4799 +/- ## ========================================== + Coverage 86.05% 86.06% +0.01% ========================================== Files 417 418 +1 Lines 37678 37710 +32 ========================================== + Hits 32423 32455 +32 Misses 5255 5255 ```

log2timeline / plaso