ydkhatri / mac_apt

macOS (& ios) Artifact Parsing Tool
https://swiftforensics.com
MIT License
779 stars 100 forks source link

fixed several tiny bugs #86

Closed mnrkbys closed 2 years ago

mnrkbys commented 2 years ago

autostart.py

Fixed a message format of log.error().

macinfo.py

Added process to normalize dest_rel_path with os.paht.normpath() macOS 12 has a symlinked plist in LaunchAgents by default which has "//" in its target path like below. So, I think we need to accept symbolic link files with such target paths.

% ls -al /System/Library/LaunchAgents/com.apple.webinspectord.plist  
lrwxr-xr-x  1 root  wheel  121  7 14 17:48 /System/Library/LaunchAgents/com.apple.webinspectord.plist -> ../../../Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/Resources//com.apple.webinspectord.plist

quicklook.py

The columns of thumbnails table in index.sqlite have been changed in macOS 12 like below.

macOS 11.6.6 スクリーンショット 2022-07-27 14 05 46

macOS 12.5 スクリーンショット 2022-07-27 14 05 10

bitmapFormat contains the same data as bitspercomponent, bitsperpixel, and bytesperrow with bplist format.

spotlightshortcuts.py

Made compatible with macOS 12.