Last Modified: 12/19/2011 - added some links to helpful

articles
Artifact

User Directories
Downloads Directory
Documents Directory
Music Directory
Desktop Directory
Library Directory
Movies Directory
Pictures Directory
Public Directory
Sites Directory
Applications
Applications

Safari
Safari Bookmarks
Safari Downloads
Safari Installed Extensions
Safari Extensions
Safari History
Safari History Index
Safari Last Session
Safari Local Storage Directory
Safari Local Storage Database
Safari Saved Desktop Image
Safari Top Sites
Safari Webpage Icons Database
Safari Webpage Databases
Safari Webpage Databases Database
Safari Cache Directory
Safari Cache
Safari Extensions Cache
Safari Webpage Previews
Safari Cookies
Safari Preferences
Safari Saved Application State Directory
Safari Bookmark Cache
Safari History Cache

Mail
Mail Cache
Mail Mailbox Directory
Mail IMAP Synched Mailboxes
Mail POP Synched Mailboxes
Mail BackupTOC
Mail Envelope Index
Mail Opened Attachments
Mail Search History
Mail Signatures by Account
Mail Smart Mailbox Info
Mail RSS Feeds
Mail Downloads Directory
Mail Preferences
Mail Recent Contacts

iChat
iChat Preferences
Saved Chats
Icon
Recent Pictures
iChat AIM Plist
iChat Jabber Plist
iChat Yahoo Plist
iChat Status Messages Plist
iChat PubSub Plist

iPhoto
iPhoto Library
Original Photos
Modified Photos
iPhoto Main Database
iDevice Photo Cache
Face Recognition Artifacts
Album Data
Album Data 2
iPhoto Spotlight File
iPhoto Recent Items
iPhoto Preferences
iPhoto Trash - See Apple Examiner paper

iTunes
iTunes Preferences
iTunes Library Directory
iTunes Media
iTunes Library Structure

Photo Booth
Recent Pictures
Photo Booth Pictures Directory
Cache
Photo Booth Preferences

Address Book
Address Book Database
Address Book Last Configuration Fetch
Address Book Preferences

Spotlight
Spotlight Directory
Shutdown Time

RSS
RSS Feeds Database
RSS Feed Plist
Feeds Directory
Mail RSS Mailbox Directory

Saved Application State

Saved Application State Directory
Saved Application Window Plist

Preferences
Preferences Directory
Global Preferences
Photo Booth Preferences
Microsoft Office Preferences and Recent Items
Calculator Preferences
Dashboard Preferences
Desktop Preferences
Disk Utility Preferences
Dock Preferences
Finder Preferences
iCal Preferences
iChat Preferences
iMovie Preferences
iPhoto Preferences
iWeb Preferences
iTunes Preferences
OnyX Preferences
KisMAC Preferences
Black Hole System Cleaner Preferences
AOL Instant Messenger Preferences
Keychain Preferences
Address Book Preferences
iApps Database Preferences
Sidebar Lists Preferences

Autorun Locations
Login Window
Login Items
Library Launch Agents
Library Launch Daemons
Library Startup Items
System Launch Daemons
System Startup Items

Recent Items
Preview Recent Items
Property List Editor Recent Items
QuickTime Recent Items
Recent Items
Screen Sharing Recent Shares
TextEdit Recent Items
VLC Video Player Recent Items
Grab Screen Shot Recent Items
Console Recent Items

Misc.
Logs Directory
Misc. Logs
Misc. Logs
Dock database
Attached iDevices
Launch Service Quarantine Events
Terminal Commands History
Owner Information Plist
Application Support Directory
Keychain Directory
Trash
OS Version Plist
User Setup Plist
Mobile Backups Directory
Flash Shared Objects
Flash Player Support
CD Information Database
Login Window Info
Bluetooth Preferences
Software Update
Time Machine Info
Remembered Wireless Networks
Document Revisions Directory
Sleep Image File
Swap Files
User Log In Password Hash Plist

Firefox
Firefox Directory
Firefox Profiles
Firefox Cookies
Firefox Downloads
Firefox Form History
Firefox History

Google Chrome
Chrome Directory
Chrome Cache
Preference Files
Chrome Helper File
Chrome Update Plist

Tor
Hidden Tor Directory
State File
VirtualBox
VirtuaBox Directory
VirtualBox Settings
VirtualBox Log File
VirtualBox Cache Directory
VirtualBox VM Directory

Drop Box
Shared Folder
Drop Box Cache Folder
Drop Box Config Folder
Drop Box Config Database
Drop Box File Cache

Skype
Skype Directory
User profile
Skype Preferences and Recent Searches
Main Skype database
Chat Sync Directory

Handbrake DVD Ripper

Handbrake Directory
Logs
Activity Log
Queue
Previews Directory
Preferences & Last Launch

Networking
Hosts file
Remembered Wireless Networks

Twitter
Twitter Preferences
Application
Twitter Cache Directory
Twitter cache file
Twitter Saved Application State Directory

iCloud
iCloud Accounts

Adium Chat Client

Chat Transcripts

CleanMyMac
Preferences and Settings

Evernote
Evernote Application Support Directory
Evernote Data/Profile Directory
Evernote Logs
Evernote Profile Info
Evernote User Content

Network Time Protocol (NTP) Validation Logs

Hostconfig FIle
NTP Config File
NTP Drift File

Sleep State Logs

Directory Service Server Log
Apple System Log
 scavanaugh@appleexaminer.com
Twitter: @spcavanaugh
Name

Downloads
Documents
Music
Desktop
Library
Movies
Pictures
Public
Sites
Applications
Applications

Bookmarks.plist
Downloads.plist
Extensions.plist
Extensions
History.plist
HistoryIndex.sk
LastSession.plist
LocalStorage
StorageTracker.db
Safari Desktop Picture.jpg
TopSites.plist
WebpageIcons.db
Databases
Databases.db
com.apple.Safari
Cache.db
Extensions
Webpage Previews
Cookies.plist
com.apple.Safari.plist
com.apple.Safari.savedState
Bookmarks
History
Cache.db
Mailboxes
IMAP-<name@address>
POP-<name@address>
BackupTOC.plist
Envelop Index
OpenedAttachments.plist
SearchHistory.plist
SignaturesByAccount.plist
SmartMailboxes.plist
RSS
Mail Downloads
com.apple.Mail.plist
MailRecents-v4.abcdmr

com.apple.iChat.plist
iChats
Pictures
iChat Recent Pictures
com.apple.iChat.AIM.plist
com.apple.iChat.Jabber.plist
com.apple.iChat.Yahoo.plist
com.apple.iChat.StatusMessages.plist
com.apple.iChat.PubSub.plist

iPhoto Library
Originals
Modified
iPhotoMain.db
iPod Photo Cache
face.db, face_blob.db
AlbumData.xml
AlbumData2.xml
iPhoto.ipspot
com.apple.iPhoto.LSSharedFileList.plist
com.apple.iPhoto.plist
http://www.appleexaminer.com/files/iPhoto_Trash_Analysis.pdf

com.apple.iTunes.plist
iTunes
iTunes Media
iTunes Music Library.xml

Recents.plist
Pictures
com.apple.PhotoBooth
com.apple.PhotoBooth.plist

AddressBook-v22.abcddb
com.apple.AddressBook.abd.plist
com.apple.AddressBook.plist

.Spotlight-V100
shutdown_time

Database.sqlite3
Clients.plist
Feeds
RSS

Saved Application State

Windows.plist

Preferences
.GlobalPreferences.plist
com.apple.PhotoBooth.plist
com.microsoft.office.plist
com.apple.Calculator.plist
com.apple.Dashboard.plist
com.apple.Desktop.plist
com.apple.DiskUtility.plist
com.apple.Dock.plist
com.apple.Finder.plist
com.apple.iCal.plist
com.apple.iChat.plist
com.apple.iMovie8.plist
com.apple.iPhoto.plist
com.apple.iWeb.plist
com.apple.iTunes.plist
com.apple.OnyX.plist
org.kismac-ng.kismac.plist
net.irradiated.Black-Hole.plist
com.aol.aim.desktop.plist
com.apple.keychainaccess.plist
com.apple.AddressBook.plist
com.apple.iApps.plist
com.apple.sidebarlists.plist

loginwindow.plist
com.apple.LoginItems.plist
LaunchAgents
LaunchDaemons
StartupItems
LaunchDaemons
StartupItems

com.apple.Preview.LSSharedFileList.plist
com.apple.PropertyListEditor.LSSharedFileList.plist
com.apple.QuickTimePlayerX.LSSharedFileList.plist
com.apple.RecentItems.plist
com.apple.ScreenSharing.LSSharedFileList.plist
com.apple.TextEdit.LSSharedFileList.plist
org.videolan.vlc.LSSharedFileList.plist
com.apple.Grab.LSSharedFileList.plist
com.apple.Console.LSSharedFileList.plist

Logs
log
Logs
com.apple.Dock.db
com.apple.iPod.plist
com.apple.LaunchServices.QuarantineEvents
.bash_history
AddressBookMe.plist
Application Support
Keychains
.Trash
SystemVersion;plist
.AppleSetupDone
MobileBackups
#SharedObjects
sys
CD Info.cidb
com.apple.loginwindow.plist
com.apple.Bluetooth.plist
com.apple.SoftwareUpdate.plist
com.apple.TimeMachine.plist
com.apple.airport.preferences.plist
.DocumentRevisions-V100
sleepimage
swapfile#
<user name>.plist

Firefox
Profiles
Cookies.sqlite
Downloads.sqlite
Formhistory.sqlite
Places.sqlite

Chrome
com.google.chrome
com.google.Chrome.plist
com.google.Chrome.helper.plst
com.google.Keystone.Agent.plist

.tor
State
VirtualBox
VirtualBox.xml
VBoxSVC.log
org.virtualbox.app.VirtualBox
VirtualBox VMs

Dropbox
com.getdropbox.dropbox
.dropbox
Config.db
filecache.db

Skype
<Skype user name>
com.skype.skype.plist
Main.db
chatsync

Handbrake
EncodeLogs
HandBrake-activtylog.txt
Queue.plist
Previews
org.m0k.handbrake.plist

hosts
com.apple.airport.preferences.plist

com.twitter.twitter-mac.plist
Twitter
com.twitter.twitter-mac
Cache.db
com.twitter.twitter-mac.savedState

Accounts

Logs

com.macpaw.CleanMyMac.plist

Evernote
data
logs
Evernote.sql
Content

hostconfig
ntp.conf
ntp.drift

DirectoryService.server.log
asl.log
 Want to add to the list? Email artifact info to scavanaugh@appleexaminer.com
http://tinyurl.com/63l2l6k
Path

/Users/<user>/Downloads/
/Users/<user>/Documents/
/Users/<user>/Music/
/Users/<user>/Desktop/
/Users/<user>/Library/
/Users/<user>/Movies/
/Users/<user>/Pictures/
/Users/<user>/Public/
/Users/<user>/Sites/
/Users/<user>/Applications/
/Applications/

/Users/<user>/Library/Safari/Bookmarks.plist
/Users/<user>/Library/Safari/Downloads.plist
/Users/<user>/Library/Safari/Extensions/Extensions.plist
/Users/<user>/Library/Safari/Extensions/
/Users/<user>/Library/Safari/History.plist
/Users/<user>/Library/Safari/HistoryIndex.sk
/Users/<user>/Library/Safari/LastSession.plist
/Users/<user>/Library/Safari/LocalStorage/
/Users/<user>/Library/Safari/LocalStorage/StorageTracker.db
/Users/<user>/Library/Safari/Saved Desktop Picture.jpg
/Users/<user>/Library/Safari/TopSites.plist
/Users/<user>/Library/Safari/WebpageIcons.db
/Users/<user>/Library/Safari/Databases/
/Users/<user>/Library/Safari/Databases/Databases.db
/Users/<user>/Library/Caches/com.apple.Safari/
/Users/<user>/Library/Caches/com.apple.Safari/Cache.db
/Users/<user>/Library/Caches/com.apple.Safari/Extensions/
/Users/<user>/Library/Caches/com.apple.Safari/Webpage Previews/
/Users/<user>/Library/Cookies/Cookies.plist
/Users/<user>/Library/Preferences/com.apple.Safari.plist
/Users/<user>/Library/Saved Application State/com.apple.Safari.savedState/
/Users/<user>/Library/Caches/Metadata/Safari/Bookmarks/
/Users/<user>/Library/Caches/Metadata/Safari/History/
/Users/<user>/Library/Caches/com.apple.Mail/Cache.db
/Users/<user>/Library/Mail/V2/Mailboxes/
/Users/<user>/Library/Mail/V2/IMAP-<name@address>
/Users/<user>/Library/Mail/V2/POP-<name@address>
/Users/<user>/Library/Mail/V2/MailData/BackupTOC.plist
/Users/<user>/Library/Mail/V2/MailData/Envelope Index
/Users/<user>/Library/Mail/V2/MailData/OpenedAttachments.plist
/Users/<user>/Library/Mail/V2/MailData/SearchHistory.plist
/Users/<user>/Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plist
/Users/<user>/Library/Mail/V2/MailData/SmartMailboxes.plist
/Users/<user>/Library/Mail/V2/RSS/
/Users/<user>/Library/Mail Downloads/
/Users/<user>/Library/Preferences/com.apple.Mail.plist
/Users/<user>/Library/Application Support/Address Book/MailRecents-v4.abcdmr

/Users/<user>/Library/Preferences/com.apple.iChat.plist
/Users/<user>/Documents/iChats/
/Users/<user>/Library/Caches/com.apple.iChat/Pictures
/Users/<user>/Library/Images/iChat Recent Pictures/

/Users/<user>/Pictures/iPhoto Library
/Users/<user>/Pictures/iPhoto /Library/Originals/
/Users/<user>/Pictures/iPhoto /Library/Modified/
/Users/<user>/Pictures/iPhoto /Library/iPhotoMain.db
/Users/<user>/Pictures/iPhoto /Library/iPod Photo Cache/
/Users/<user>/Pictures/iPhoto /Library/
/Users/<user>/Pictures/iPhoto /Library/AlbumData.xml
/Users/<user>/Pictures/iPhoto /Library/AlbumData2.xml
/Users/<user>/Pictures/iPhoto /Library/iPhoto.ipspot
/Users/<user>/Library/Preferences/com.apple.iPhoto.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.iPhoto.plist

/Users/<user>/Library/Preferences/com.apple.iTunes.plist
/Users/<user>/Music/iTunes/
/Users/<user>/Music/iTunes/iTunes Media/
/Users/<user>/Music/iTunes/iTunes Music Library.xml

/Users/<user>/Pictures/Photo Booth /Library/Recents.plist

/Users/<user>/Pictures/Photo Booth /Library/Pictures/
/Users/<user>/Library/Caches/com.apple.PhotoBooth/
/Users/<user>/Library/Preferences/com.apple.PhotoBooth.plist

/Users/<user>/Library/Application Support/Address Book/AddressBook-v22.abcddb

/Users/<user>/Library/Preferences/com.apple.AddressBook.abd.plist
/Users/<user>/Library/Preferences/com.apple.AddressBook.plist

/Users/<user>/.Spotlight-V100/
/Users/<user>/.Spotlight-V100/Store-V<#>/<GUID>/shutdown_time

/Users/<user>/Library/PubSub/Database/Database.sqlite3
/Users/<user>/Library/PubSub/Clients.plist
/Users/<user>/Library/PubSub/Feeds/
/Users/<user>/Library/Mail/V2/RSS/

/Users/<user>/Library/Saved Application State/

/Users/<user>/Library/Saved Application State/<application.savedState>/Windows.plist

/Users/<user>/Library/Preferences/
/Users/<user>/Library/Preferences/.GlobalPreferences.plist
/Users/<user>/Library/Preferences/com.apple.photobooth.plist
/Users/<user>/Library/Preferences/com.microsoft.office.plist
/Users/<user>/Library/Preferences/com.apple.Calculator.plist
/Users/<user>/Library/Preferences/com.apple.Dashboard.plist
/Users/<user>/Library/Preferences/com.apple.Desktop.plist
/Users/<user>/Library/Preferences/com.apple.DiskUtility.plist
/Users/<user>/Library/Preferences/com.apple.Dock.plist
/Users/<user>/Library/Preferences/com.apple.Finder.plist
/Users/<user>/Library/Preferences/com.apple.iCal.plist
/Users/<user>/Library/Preferences/com.iChat.plist
/Users/<user>/Library/Preferences/com.apple.iMovie8.plist
/Users/<user>/Library/Preferences/com.apple.iPhoto.plist
/Users/<user>/Library/Preferences/com.apple.iWeb.plist
/Users/<user>/Library/Preferences/com.apple.iTunes.plist
/Users/<user>/Library/Preferences/com.OnyX.plist
/Users/<user>/Library/Preferences/org.kismac-ng.kismac.plist
/Users/<user>/Library/Preferences/net.irradiated.Black-Hole.plist
/Users/<user>/Library/Preferences/com.aol.aim.desktop.plist
/Users/<user>/Library/Preferences/com.apple.keychainaccess.plist
/Users/<user>/Library/Preferences/com.apple.AddressBook.plist
/Users/<user>/Library/Preferences/com.apple.iApps.plist
/Users/<user>/Preferences/com.apple.sidebarlists.plist

/Users/<user>/Library/Preferences/loginwindow.plist
/Users/<user>/Library/Preferences/com.apple.loginitems.plist
/Library/LaunchAgents/
/Library/LaunchDaemons/
/Library/StartupItems/
/System/Library/LaunchDaemons/
/System/Library/StartupItems/

/Users/<user>/Library/Preferences/com.apple.Preview.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.PropertyListEditor.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.QuickTimePlayerX.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.recentitems.plist
/Users/<user>/Library/Preferences/com.apple.ScreenSharing.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.TextEdit.LSSharedFileList.plist
/Users/<user>/Library/Preferences/org.videolan.vlc.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.Grab.LSSharedFileList.plist
/Users/<user>/Library/Preferences/com.apple.Console.LSSharedFileList.plist

/Users/<user>/Library/Logs/
/var/log/
/Library/Logs/
/Users/<user>/Library/Preferences/com.apple.Dock.db
/Users/<user>/Library/Preferences/com.apple.iPod.plist
/Users/<user>/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
/Users/<user>/.bash_history
/Users/<user>/Library/Preferences/AddressBookMe.plist
/Users/<user>/Library/Application Support/
/Users/<user>/Library/Keychains/
/Users/<user>/.Trash/
/System/Library/CoreServices/SystemVersion.plist
/private/var/db/.AppleSetupDone
/Volumes/MobileBackups/
/Users/<user>/Preferences/Macromedia/Flash Player/#SharedObjects/
/Users/<user>/Preferences/Macromedia/Flash Player/support/flash player/sys/
/Users/<user>/Preferences/CD Info.cidb
/Library/Preferences/com.apple.loginwindow.plist
/Library/Preferences/com.apple.Bluetooth.plist
/Library/Preferences/com.apple.SoftwareUpdate.plist
/Library/Preferences/com.apple.TimeMachine.plist
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
/Users/<user>/.DocumentRevisions-V100/
/var/vm/sleepimage
/var/vm/swapfile#
/var/db/dslocal/nodes/Default/users/

/Users/<user>/Library/Application Support/Firefox/
/Users/<user>/Library/Application Support/Firefox/Profiles/
/Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Cookies.sqlite
/Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Downloads.sqlite
/Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Formhistory.sqlite
/Users/<user>/Library/Application Support/Firefox/Profiles/<profile>/Places.sqlite

/Users/<user>/Library/Application Support/Google/Chrome/
/Users/<user>/Library/Caches/com.google.Chrome/
/Users/<user>/Library/Preferences/com.google.Chrome.plist
/Users/<user>/Library/Preferences/com.google.Chrome.helper.plist
/Users/<user>/Library/Preferences/com.google.Keystone.Agent.plist

/Users/<user>/.tor
/Users/<user>/.tor/State
/Users/<user>/Library/VirtualBox/
/Users/<user>/Library/VirtualBox/VirtualBox.xml
/Users/<user>/Library/VirtualBox/VBoxSVC.log
/Users/<user>/Library/Caches/org.virtualbox.app.VirtualBox/
/Users/<user>/VirtualBox VMs/

/Users/<user>/Dropbox
/Users/<user>/Library/Caches/com.getdropbox.dropbox
/Users/<user>/.dropbox/
/Users/<user>/.dropbox/Config.db
/Users/<user>/.dropbox/filecache.db

/Users/<user>/Library/Application Support/Skype/
/Users/<user>/Library/Application Support/Skype/<Skype user name>/
/Users/<user>/Library/Preferences/com.skype.skype.plist
/Users/<user>/Library/Application Support/Skype/<Skype user name>/Main.db
/Users/<user>/Library/Application Support/Skype/<Skype user name>/chatsync/

/Users/<user>/Library/Application Support/Handbrake/
/Users/<user>/Library/Application Support/Handbrake/EncodeLogs/
/Users/<user>/Library/Application Support/Handbrake/HandBrake-activitylog.txt
/Users/<user>/Library/Application Support/Handbrake/Queue.plist
/Users/<user>/Library/Application Support/Handbrake/Previews/
/Users/<user>/Library/Preferences/org.m0k.handbrake.plist

/etc/hosts
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

/Users/<user>/Library/Preferences/com.twitter.twitter-mac.plist
/Applications/Twitter.app/
/Users/<user>/Library/Caches/com.twitter.twitter-mac
/Users/<user>/Library/Caches/com.twitter.twitter-mac/Cache.db
/Users/<user>/Library/Saved Application State/com.twitter.twitter-mac.savedState

/Users/<user>/Library/iCloud/Accounts/

/Users/<user>/Library/Application Support/Adium 2.0/Users/Default/Logs/

/Users/<user>/Library/Preferences/com.macpaw.CleanMyMac.plist

/Users/<user>/Library/Application Support/Evernote/
/Users/<user>/Library/Application Support/Evernote/data/
/Users/<user>/Library/Application Support/Evernote/logs/
/Users/<user>/Library/Application Support/Evernote/data/<profile>/Evernote.sql
/Users/<user>/Library/Application Support/Evernote/data/<profile>/Content/

/private/etc/hostconfig
/private/etc/ntp.conf
/private/var/run/ntp.drift

/Library/Logs/DirectoryService/DirectoryService.server.log
/private/var/log/asl.log
https://docs.google.com/spreadsheet/ccc?key=0AkBdGlxJhW-ydDlxVUxWUVU0dXVzMzUxRzh2b2ZzaFE&hl=en_US#gid
Notes

Hidden directory in Lion

Not user-specific

Plist listing default and user-added Safari bookmarks

Plist listing files downloaded using Safari Browser
Plist describing installed Safari Extensions
Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension.
Plist listing Safari web browsing history
An index of Safari History allowing a user to perform keyword searches of visited webpages
A plist describing the state of Safari when it was last closed
A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .localstorage.
A database listing the webpage specific databases
Will persist in directory after desktop picture has been changed to something else
A Plist listing the webpages belonging to a Safari's Top Sites
A database containing saved web page icons for webpages visited
A directory for webpage-specific database storage
A database that keeps track of stored webpage-specific databases
A directory containing Safari-specific cache items
A cache of data from visited webpages
A directory containing cached items for Safari Extensions
A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage URL.
A Plist containing cookies from visited webpages
Contains recent safari search strings and downloads folder location in addition to preferences

Each bookmark entry in Bookmarks.plist is stored as an individual file in this directory for more efficient use with Spotlight and to a
Each website entry in History.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow th
Cached images from email messages
Apple Mail Mailboxs
Synched IMAP Account(s)
Synched POP Account(s)
Backup Plist that defines the mailbox structure
Keeps track of the location of Mail messages - the content of some messages is present as well
Plist listing opened Mail attachments
Plist listing search terms entered into Mail's search box
Plist containing Mail signatures
Smart Mailbox information
Directory containing RSS feed mailboxes
Directory containing files downloaded from email messages
Mail preferences
SQLite database stored in Address Book's support directory containing recent Mail contacts

iChat preferences and user account information

User iChat icon

Recent user iChat pictures

Specialized folder that contains user's iPhoto pictures

Contains original versions of all photos
Contains modified versions of photos
Contains detailed information about iPhoto library
Directory of folders containing .ithmb photos synced to iDevice. Folder modified date/time stamp updated upon sync.
SQLite databases containing data about recognized faces
Plist containing information about some iPhoto albums/events and path/photo ID info for each picture in the library
Plist containing information about some iPhoto albums/events and other iPhoto information

iPhoto Recent Items - typically only contains iPhoto Library package

iPhoto preferences

iTunes preferences
iTunes library directory
Directory containing iTunes media files
XML file defining the iTunes music library

A Plist listing the recent photos and videos taken using Photo Booth. Items deleted by the user will not be saved to this list.
A directory containing the user's Photo Booth pictures
Photo Booth cache directory
Photo Booth preferences

SQLite database containing contact information

Address Book preferences

Spotlight directory containing text indexes

Last shutdown time stored as a Unix 32-bit hex value in Little Endian

SQLite database containing RSS Feed information

Plist containing RSS Feed information

A directory containing folders pertaining to the saved state of OS X applications

A property list describing the state of the windows during the applications last use

Directory containing user preference settings for applications and utilities

Global Preferences Plist
Photo Booth preferences
Office preferences and recent items
Contains recent conversions
Dashboard preferences including installed widgets
Desktop preferences including current Desktop background picture
Disk Utility preferences including recent disk images
Dock preferences including persistent apps and directories
Finder preferences including mounted volumes
iCal preferences
iChat accounts, preferences, away messages, recent chats, etc.
iMovie preferences and recent items
iPhoto preferences
iWeb preferences
iTunes preferences
OnyX preferences
KisMAC preferences
Black Hole System Cleaner Preferences & Last launch time
AIM preferences & account info
Keychain preferences including last accessed Keychain
Address Book preferences
Plist listing the paths of iApp (iTunes, iPhoto, etc.) databases
Lists the names of volumes mounted on the desktop that have appeared in the sidebar list

Plist containing applications that are launched when the user logs in
Plists listing applications that automatically start when the user is logged in

Preview recent items

Property list Editor recent items
QuickTime recent items
Recently opened applications, files, and servers
Recent screen shares
TextEdit recent items
VLC recent items
Screenshots recently taken and saved with Grab
Recent logs viewed with Console

Directory containing numerous log files

Database containing directories, files, and apps that have appeared in the Dock
Attached iDevices
SQLite database that keeps track of files that have the quarantine extended attribute that is given to applications, scripts, and execut
Terminal commands history
Plist containing user information such as name, address, phone number, etc.
Contains application-specific folders used to support applications and utilities
Directory containing user keychain files
User Trash directory
Plist describing the installed Operating System
Plist listing the information entered by the user at the time of the OS setup
Local Time Machine backup directory stored on disk. Time Machine backups are created and stored here when Time Machine backu
Contains Flash shared object artifacts that identify webpages visited
Contains Flash player support artifacts that identify webpages visited
A database file used to "remember" CD's (user-created & store bought). Also, the file gets updated if a user manually enters track nam
Plist containing password hints and last user logged in
Bluetooth preferences and paired devices
Plist describing last attempt and last successful attempt at updating OS X software
Time Machine backup info
Remembered wireless networks
Directory containing automatically saved versions of files
Contents of RAM are written to this file when the computer is put to sleep
Numerous swap
Contains the files
salted may be hash
SHA-512 foundvalue
in this
fordirectory with
the user's log the naming convention
in password of swapfile# (swapfile0, swapfile1, swa
- http://www.defenceindepth.net/2011/09/crack
passwords.html

Directory containing user artifacts for Mozilla Firefox web browser

Text entered into forms including search terms, email addresses, and login information.

Directory containing user artifacts for Google Chrome web browser

Google Chrome cache directory

Text fie describing the version of Tor used and the last time it was ran
Directory containing VirtualBox configuration files
An XML file describing VirtualBox settings. Contains information about recently run virtual machines.
VirtualBox log file
VirtualBox cache directory
Directory for VirtualBox virtual machines

Drop Box cache directory

Hidden configuration folder for Drop Box
SQLite database containing configuration information, such as Drop Box directory path and user email account.
SQLite database containing information about files stored in Drop Box directory.

Directory containing Skype user artifacts

Directory containing Skype user artifacts
Skype preferences and recent user searches
Database of contacts, SMS's, calls, conversations, videos, messages, etc.
Directory containing chat logs

Directory for Handbrake DVD ripper

Log files for each rip
Activity log
HandBrake queue
Contains previews of unfinished rips
Handbrake preferences & last launch time

Remembered wireless networks

Twitter application folder

Twitter cache directory
SQLite database file containing cached Twitter feed data
Twitter saved application state directory

directory containing Adium chat transcripts

Contains user profiles and Evernote user data

Evernote profile info - contains various information about the user's Evernote account such as last sync, titles of Evernote entries, ur
Contains the content of the user's Evernote data. Content stored as HTML, XML, graphics, and various other non-proprietary file typ
e user to select the bookmark entry from Spotlight and have Safari launch the corresponding webpage
to select the webpage entry from Spotlight and have Safari launch the corresponding webpage
ownloaded from potentially untrustworthy locations/people. The SQLite database contains URLS, email addresses, email subjects, and other pote

s not available.
er info, lat/long coords, etc.
email subjects, and other potentially useful information.