AUTOSTART
The AUTOSTART plugin retrieves information for persistent and auto-start programs, daemons, and services.
This plugin does not support standalone mode.
| Type | Path |
|---|---|
| Kernel Extension | /System/Library/Extensions/* /Library/Extensions/* |
| Daemon | /System/Library/LaunchDaemons/* /Library/LaunchDaemons/* |
| Agents | /System/Library/LaunchAgents/* /Library/LaunchAgents/* |
| Periodic | /private/etc/periodic/daily/* /private/etc/periodic/monthly/* /private/etc/periodic/weekly/* |
| Login Item / Apps To Relaunch At Login | /Users/{user}/Library/Preferences/(com.apple.loginitems.plist)(ByHost/com.apple.loginwindow.3FE1266D-6E79-538E-B66A-60A4B6902736.plist) |
$ python mac-apt.py -x -o ~/Case_Output E01 ~/Acquisition.E01 AUTOSTART
| Field Name | Notes |
|---|---|
| Type | Type of Auto-start service; Kernel Extension, Agents, Daemon, Periodic, Launch Script, Login Item, Apps To Relaunch At Login |
| Name | Name of Auto-start service |
| User | User associated with the Auto-start service |
| StartupType | Type of startup |
| Disabled | (Boolean) Whether or not the auto-startup service is disabled |
| AppPath | Path of the application the Auto-start service is associated with |
| Source | Source file from which the autostart information was retrieved |