Add MacOS applications path

[Zawadidone]

References

• https://github.com/fox-it/dissect.target/blob/b6ea46e2ed95321440df6c8c6b65803af06da859/dissect/target/plugins/os/unix/bsd/osx/_os.py#L21
• https://github.com/ForensicArtifacts/artifacts/blob/ae1baa1675e43d199721dd2e97678ac56330b5a1/data/macos.yaml#L97-L106

[Zawadidone]

The acquire container is larger compared to a Windows container, but these paths could contain valuable forensics traces and are needed by target-query (https://github.com/fox-it/dissect.target/blob/b6ea46e2ed95321440df6c8c6b65803af06da859/dissect/target/plugins/os/unix/bsd/osx/_os.py#L21) to detect the OSX operating system.

ls -lh dissect.sys_20230829104939.tar 
-rw-r--r-- 1 root staff 21G Aug 29 13:15 dissect.sys_20230829104939.tar
target-query -f hostname,os,version -t dissect.sys_20230829104939.tar  
<Target dissect.sys_20230829104939.tar> osx dissect.sys macOS 13.4 (22F66)

[Schamper]

That's quite a bit larger. Can you give some examples of the forensic value? For the OS plugin, we can probably fix that some other way.

Perhaps it's an idea to only put this in the full profile for MacOS?

[Zawadidone]

I mixed up the folders.

For the path Applications the file Info.plist is enough which gives an overview of installed applications (https://developer.apple.com/documentation/bundleresources/information_property_list).

The path /Library/Application Support is used in many blog post written by Objective See and observed by us in a few 3CX incidents. I have added a filter because the files that are of interest are usually not that big.

[Schamper]

I see, that makes more sense!

[codecov]

Codecov Report

Merging #96 (9e4528c) into main (49e177e) will increase coverage by 0.08%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main      #96      +/-   ##
==========================================
+ Coverage   44.30%   44.38%   +0.08%     
==========================================
  Files          22       22              
  Lines        2767     2771       +4     
==========================================
+ Hits         1226     1230       +4     
  Misses       1541     1541              

Flag	Coverage Δ
unittests	44.38% <100.00%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
acquire/acquire.py	41.27% <100.00%> (+0.24%)	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more