NOTIFICATIONS
The NOTIFICATIONS plugin parses data from a SQLite database file located at the paths below. The location for this database has changed after Yosemite.
| macOS Version | Path |
|---|---|
| Snow Leopard, Lion, Mountain Lion, Mavericks | /Users/{USER}/Library/Application Support/NotificationCenter/.db |
| Yosemite, El Capitan, Sierra | DARWIN_USER_DIR/com.apple.notificationcenter/db/db |
| High Sierra | DARWIN_USER_DIR/com.apple.notificationcenter/db2/db |
*DARWIN_USER_DIR path will be /private/var/folders/xx/yyyyyyy/0 where xx/yyyyyyy looks like a random string and is different for every user.
This plugin supports standalone mode.
$ python mac-apt.py -x -o ~/Case_Output E01 ~/Acquisition.E01 NOTIFICATIONS
| Field Name | Notes |
|---|---|
| User | User account. |
| Date | Date/time (UTC) that the notification was created. |
| Shown | ? |
| Bundle | Associated com.apple...plist app info. |
| AppPath | Path of Application that created a notification. |
| UUID | UUID of notification. |
| Title | Title of the notification. |
| SubTitle | Subtitle (if any) to the notification. |
| Message | Message content within the notification. |
| SourceFilePath | Source path of the db file containing notification information. |