plaso icon indicating copy to clipboard operation
plaso copied to clipboard

Update the known wifi networks parser for MacOS

Open anttitikkanen opened this issue 3 years ago • 2 comments

Description of problem:

Since MacOS Big Sur (and later), the known wifi network information has moved from /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist to /Library/Preferences/com.apple.wifi.known-networks.plist.

The plugin could be updated to support this: https://github.com/log2timeline/plaso/blob/main/plaso/parsers/plist_plugins/airport.py

Plaso version:

Latest

Note: I'm happy to contribute this change!

anttitikkanen avatar Feb 08 '22 17:02 anttitikkanen

Note: I'm happy to contribute this change!

Thx, much appreciated, I'll assign the issue to you then. Let me know if there are questions about the review / development process.

joachimmetz avatar Feb 08 '22 17:02 joachimmetz

Observations /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist is still present on Monterey 12.1

/Library/Preferences/com.apple.wifi.known-networks.plist does not appear to be always present

joachimmetz avatar May 01 '22 15:05 joachimmetz