Posts tagged "plist"

Collecting Quick Look Data From a Live macOS System

June 5th, 2018 Posted by Uncategorized 0 thoughts on “Collecting Quick Look Data From a Live macOS System”

After reading about how to manually analyze Quick Look data, we’re sharing with you a method to collect Quick Look data on a live macOS machine so you can test and validate cached data yourself!

Check out our walkthrough video and the steps following:

Arsenal Quick Look Cache Parsing Video

(more…)

Quick Look Cache Parsing

June 4th, 2018 Posted by Uncategorized 0 thoughts on “Quick Look Cache Parsing”

In our intellectual property theft investigations, our clients will often ask us about specific file names they care about, especially when data theft or destruction is suspected. Often these files are keys to the kingdom: proprietary engineering plans, customer lists, or confidential financial information.

(more…)