Re-Opened Apps
Overview
Evidence: Re-Opened Apps
Description: Collect Re-Opened Apps
Category: System
Platform: macos
Short Name: reapps
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Re-opened apps preference tracks files and apps restored at login. This data is essential for understanding user session restoration and potential persistence via loginwindow.
Data Collected
This collector gathers structured data about re-opened apps.
Re-Opened Apps Data
| Field | Description | Example |
|---|---|---|
Plist | Plist | Example value |
FilePath | File Path | Example value |
OriginalFilename | Original Filename | Example value |
FileType | File Type | Example value |
SHA1 | SHA1 | Example value |
SizeInBytes | Size In Bytes | 123 |
FileCreated | File Created | 2023-10-15 14:30:25+03:00 |
FileLastAccessed | File Last Accessed | 2023-10-15 14:30:25+03:00 |
FileLastChanged | File Last Changed | 2023-10-15 14:30:25+03:00 |
FileLastModified | File Last Modified | 2023-10-15 14:30:25+03:00 |
Collection Method
This collector joins plist, hash, and file tables to enumerate ByHost loginwindow plists and referenced items, recording metadata into re_opened_apps.
Forensic Value
This evidence is crucial for forensic investigations as it highlights recently accessed items and auto‑restored apps that may indicate user behavior or malicious persistence.