Keyboard Dictionary

Overview

Evidence: Keyboard Dictionary
Description: Collects the list of words in the keyboard dictionary
Category: System
Platform: macos
Short Name: keydict
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

Keyboard dictionary entries contain user-added words for autocorrect. This data is essential for profiling user terminology and contextualizing typed content.

Data Collected

This collector gathers structured data about keyboard dictionary.

Collection Method

This collector reads each user’s LocalDictionary file and records entries into keyboard_dictionary.

Forensic Value

This evidence is crucial for forensic investigations as it can indicate custom vocabulary relevant to the case and user behavior.