Installed Applications

Overview

macOS tracks installed applications through multiple mechanisms: application bundles in standard directories, an installation history plist recording every installer-based install and update, and Launch Services registration. Together these artifacts provide a complete software inventory with installation dates, sources, and version information.

Forensic Significance

File Locations

Data Format

InstallHistory.plist

An array of dictionaries, one per installation event, sorted chronologically:

Application Bundle Info.plist

Each .app bundle contains Contents/Info.plist with:

Key Fields for Analysis

Parse Install History

# List all installations with dates (most recent first)
plutil -convert json -o - /Library/Receipts/InstallHistory.plist | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for item in reversed(data):
    print(f\"{item.get('date','?')}\t{item.get('processName','?')}\t{item.get('displayName','?')}\t{item.get('displayVersion','?')}\")
"

List Installed Applications

# List all apps with bundle IDs and versions
for app in /Applications/*.app; do
    id=$(defaults read "$app/Contents/Info" CFBundleIdentifier 2>/dev/null)
    ver=$(defaults read "$app/Contents/Info" CFBundleShortVersionString 2>/dev/null)
    echo "$id    $ver    $app"
done

Analysis Notes

• Install source identification: The processName field in InstallHistory distinguishes between installer (PKG-based installs), softwareupdated (Apple software updates), storedownloadd (App Store downloads), and others.
• Timestamp correlation: Installation dates can be correlated with FSEvents, quarantine events, and browser history to trace the full download-to-install chain.
• Removed app evidence: InstallHistory.plist retains records even after an application has been uninstalled. This provides evidence of previously installed software.
• Code signing verification: Use codesign -dv --verbose=4 on application bundles to verify code signing status, team ID, and whether the app has been modified.
• Hidden applications: Check non-standard locations like ~/Library/, /usr/local/, and hidden directories for applications installed outside normal paths.

Version Differences

Tool Support

References

• Apple Bundle Programming Guide
• SANS FOR518: Mac and iOS Forensic Analysis