From 4e41852945d2adaeb3837c804159ce58512dcc17 Mon Sep 17 00:00:00 2001
From: "Yogesh Khatri (@swiftforensics)" <yogesh@swiftforensics.com>
Date: Fri, 10 May 2024 10:54:19 +1000
Subject: [PATCH] Add deleted user as user for darwin folder parsing

---
 plugins/helpers/macinfo.py | 11 +++++++++++
 plugins/users.py           |  1 -
 version.py                 |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/plugins/helpers/macinfo.py b/plugins/helpers/macinfo.py
index 8e7fec2..fd1ad5e 100644
--- a/plugins/helpers/macinfo.py
+++ b/plugins/helpers/macinfo.py
@@ -987,6 +987,17 @@ def _GetDarwinFoldersInfo(self):
                             break
                     if not found_user:
                         log.error('Could not find username for UID={} GID={} PATH={}'.format(uid, gid, path))
+                        log.info(f'Creating new user as unknown_uid_{uid}')
+                        deleted_user = UserInfo()
+                        deleted_user.DARWIN_USER_DIR       = path + '/0'
+                        deleted_user.DARWIN_USER_CACHE_DIR = path + '/C'
+                        deleted_user.DARWIN_USER_TEMP_DIR  = path + '/T'
+                        deleted_user.real_name = f'unknown_uid_{uid}'
+                        deleted_user.user_name = f'unknown_uid_{uid}'
+                        deleted_user.home_dir = '/UNKNOWN/'
+                        deleted_user.UID = str(uid)
+                        deleted_user.GID = str(gid)
+                        self.users.append(deleted_user)
 
     def _GetSystemInfo(self):
         ''' Gets system version information'''
diff --git a/plugins/users.py b/plugins/users.py
index e291edf..0f25ddd 100644
--- a/plugins/users.py
+++ b/plugins/users.py
@@ -82,7 +82,6 @@ def GetAutoLoginUser(mac_info):
             log.error('Failed to read plist ' + loginwindow_plist_path + " Error was : " + error_message)
     return user
 
-#Not sure if this still exists post 10.9
 def GetDeletedUsers(mac_info):
     deleted_users = []
     plist_path = '/Library/Preferences/com.apple.preferences.accounts.plist'
diff --git a/version.py b/version.py
index c5c1f85..2eba699 100644
--- a/version.py
+++ b/version.py
@@ -1 +1 @@
-__VERSION = "1.7.3.dev (20240330)"
\ No newline at end of file
+__VERSION = "1.7.5.dev (20240510)"
\ No newline at end of file