• Blog
  • Resources
  • Training & Events
  • Menu

mac4n6.com

  • Blog
  • Resources
  • Training & Events

Script Update - Mac MRU Parser v1.3 - New 10.13 *.sfl2 MRU Files

October 17, 2017 in scripts, update, analysis

Just a quick script update!

New with 10.13 High Sierra are the newer format *.sfl2 Mac MRU files. The format changes slightly from the older *.sfl files found in 10.11 and 10.12. It also uses the analyst infuriating NSKeyedArchiver format. An example of the Recent Applications MRU can be seen below.

The updated script can be found here.

Tags: script, sfl, macmru
Prev / Next

mac4n6.com

A macOS and iOS Forensic Research Blog


mac4n6 Blog RSS

Latest Posts

Blog
New Presentation - Using Apple Intelligence (AI) Data in Investigations
New Presentation - Using Apple Intelligence (AI) Data in Investigations
about 4 months ago
Sikkerhetsfestivalen 2024 - Lillehammer, Norway
about 9 months ago
I'm Back Baby!
I'm Back Baby!
about a year ago
Part 3: Step-by-step Tooling for iOS Research (via @bizzybarney)
Part 3: Step-by-step Tooling for iOS Research (via @bizzybarney)
about 4 years ago
APOLLO v1.4 - Now with 'Gather' Function from iOS/macOS and updates to iOS14 and macOS 11 modules
APOLLO v1.4 - Now with 'Gather' Function from iOS/macOS and updates to iOS14 and macOS 11 modules
about 4 years ago
Analysis of Apple Unified Logs [Entry 12] – Quick & Easy Unified Log Collection from iOS Devices for Testing
Analysis of Apple Unified Logs [Entry 12] – Quick & Easy Unified Log Collection from iOS Devices for Testing
about 4 years ago
Part 2: Step-by-step iPhone Setup for iOS Research (via @bizzybarney)
Part 2: Step-by-step iPhone Setup for iOS Research (via @bizzybarney)
about 4 years ago
Part 1: Step-by-step macOS Setup for iOS Research (via @bizzybarney)
Part 1: Step-by-step macOS Setup for iOS Research (via @bizzybarney)
about 4 years ago
Follow-on to DFIR Summit Talk: Lucky (iOS) 13: Time To Press Your Bets (via @bizzybarney)
Follow-on to DFIR Summit Talk: Lucky (iOS) 13: Time To Press Your Bets (via @bizzybarney)
about 5 years ago
Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
about 5 years ago

Tweets

  • RT @objective_see: Objective by the Sea (#OBTS) v6.0 will be held Oct 9ᵗʰ - 13ᵗʰ 2023🍎🧑🏻‍🏫🧑🏻‍💻🌴☀️ More details (location, CFP, etc.)… https://t.co/OJ7MaNrDPH
    Feb 18, 2023, 4:28 PM
  • RT @Fox0x01: Exciting news! My book is finally 100% finished and in production. The release date is scheduled for May 2023! 🥳 I… https://t.co/9j5owgrmlJ
    Jan 19, 2023, 5:41 PM
  • RT @NibblsNBits: Sharing for visibility. Did you know about the free virtual seats being offered by @hexordia? Intro and refresher m… https://t.co/ZWYzfo0QJD
    Jan 13, 2023, 5:47 PM