Overview
The macOS Dock preferences plist stores the user's Dock configuration including pinned applications, recent applications, persistent documents, and minimised windows. This artifact reveals which applications the user considers important enough to pin, recently used applications (even if history has been cleared elsewhere), and files the user has quick access to.
Forensic Significance
| Evidence Type | Forensic Value |
|---|
| Pinned applications | Apps the user deliberately added to the Dock |
| Recent applications | Recently launched apps (independent of other logs) |
| Persistent documents | Files/folders the user placed in the Dock |
| Minimised windows | Evidence of open applications |
| Removed items | Changes to Dock configuration over time |
File Locations
| File | Path | Format |
|---|
| Dock preferences | ~/Library/Preferences/com.apple.dock.plist | Binary plist |
Key arrays in the plist:
| Key | Type | Description |
|---|
persistent-apps | Array | Applications pinned to the left side of the Dock |
persistent-others | Array | Files, folders, and URLs pinned to the right side |
recent-apps | Array | Recently used applications (if "Show recent applications" is enabled) |
Each entry in persistent-apps contains:
| Key Path | Description |
|---|
tile-data.file-label | Application display name |
tile-data.file-data._CFURLString | Full path to the application |
tile-data.bundle-identifier | Application bundle ID |
tile-data.file-mod-date | Last modification date |
GUID | Unique identifier for the Dock item |
Key Fields for Analysis
# List all pinned applications
defaults read com.apple.dock persistent-apps | grep "file-label" | sed 's/.*= "\(.*\)";/\1/'
# List recent applications
defaults read com.apple.dock recent-apps 2>/dev/null | grep "file-label"
# Full Dock state as JSON
plutil -convert json -o - ~/Library/Preferences/com.apple.dock.plist | python3 -m json.tool
Analysis Notes
- User intent: Pinned applications represent deliberate user choices, indicating frequently used or important software.
- Recent apps: The recent-apps list provides independent corroboration of application usage, separate from CoreAnalytics or KnowledgeC.
- Path analysis: Full application paths in the Dock can reveal non-standard installation locations (e.g., apps installed in home directories or temporary locations).
- Removed applications: If an application was uninstalled but remains in the Dock preferences (as a broken reference), it indicates the app was previously installed and used.
| Tool | Support |
|---|
| macfor | Not yet implemented (planned) |
| defaults / plutil (macOS built-in) | Read Dock preferences |
References