Dock Items
Overview
Evidence: Dock Items
Description: Collect Dock Items
Category: System
Platform: macos
Short Name: dckitms
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Dock preferences record persistent apps, folders, and recent items displayed in the macOS Dock. This data is essential for understanding user activity and potential persistence via Dock items.
Data Collected
This collector gathers structured data about dock items.
Dock Items Data
| Field | Description | Example |
|---|---|---|
GUID | GUID | 123 |
User | User | Example value |
FileLabel | File Label | Example value |
ParentModified | Parent Modified | 2023-10-15 14:30:25+03:00 |
FileModified | File Modified | 2023-10-15 14:30:25+03:00 |
RecentlyUsed | Recently Used | true |
FileType | File Type | 123 |
FileTypeName | File Type Name | Example value |
FilePath | File Path | Example value |
Source | Source | Example value |
Collection Method
This collector reads users’ com.apple.dock.plist files, decodes entries, and records items into the dock_items table.
Forensic Value
This evidence is crucial for forensic investigations as it reveals recently used and pinned applications, supporting timeline and behavior analysis.