osxcollector icon indicating copy to clipboard operation
osxcollector copied to clipboard

Consider including /var/db/receipts directory in osxcollector outptut

Open ivanlei opened this issue 9 years ago • 1 comments

There is some pretty cool information in /var/db/receipts. Perhaps this would be useful in our malware investigations.

Use lsbom and plutil -convert xml1 to read the contents of the packages that were installed.

ivanlei avatar Jul 06 '15 18:07 ivanlei