Printer Info
Overview
Evidence: Printer Info
Description: Collect printer info
Category: System
Platform: macos
Short Name: prnt
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
CUPS destinations and options describe configured printers on macOS. This data is essential for understanding printing infrastructure and potential exfiltration channels.
Data Collected
This collector gathers structured data about printer info.
Printer Info Data
| Field | Description | Example |
|---|---|---|
Name | Name | Example value |
OptionName | Option Name | Example value |
OptionValue | Option Value | Example value |
Collection Method
This collector queries the cups_destinations table via osquery and records results into printer_info.
Forensic Value
This evidence is crucial for forensic investigations as it identifies available printers and configurations relevant to data leakage scenarios.