Dailies Mac OS
I had a moment of self-doubt the other morning: am I man or automaton? The question came up when I fired up my office computer and started manually launching one set of programs and changing the statuses on others.
“Why,” I asked myself, “do I do the same set of repetitive tasks every morning and every evening when I have AppleScript?” I couldn’t answer my own question.
So I fired up AppleScript Editor (Applications/Utilities), and started to type. My goal was to create a script that would perform all the little steps I take at the beginning and end of each computing day. This is what I came up with:
Dailies Mac Os Download
The following version: 1.1 is the most frequently downloaded one by the program users. Webdailies.zip is the default file name to indicate this program's installer. The actual developer of this free software for Mac is Malarkey Software. This Mac download was checked by our antivirus and was rated as virus free. DaisyDisk also gives you a great overview of all connected disks, be it Macintosh HD, Thunderbolt disk, flash, network storage, you name it. All displayed data are updated in real time, so you can always tell if there’s enough space to install a new game or download an HD movie. Any.do is a calendar, a notepad, a board for post its or sticky notes, a project management tool for small teams, your daily schedule, and overall the simplest and most useful organizer you will ever have. Best of all – it’s free for basic use! Any.do is also great when you’re planning to go shopping at the grocery store. Global Nav Open Menu Global Nav Close Menu; Apple; Shopping Bag +. Jul 25, 2020 Besides using Laptop for the day to day tasks like Coding, Surfing Videos, Listening To Music, etc, I’ve always been inquisitive in seeking more knowledge about the things which I can do that a.
The first line of script creates a dialog box that asks me if I’m arriving or departing, setting the default answer to arriving. You could add additional options by inserting them in quotation marks, separated by commas, in the list after buttons. For instance,
The next line checks my response. If I click on Arriving, the script carries out the first series of application actions. If I click on Departing, it performs the second batch (after else).
For those of you who haven’t used AppleScript before: You’ll see the format for each individual action is the same: tell specifies a program, the indented block tells it what to do, and the end tell ends that section. Some of the commands in those indented blocks are generic (activate). Others are more specific to the particular program. The latter are found in the AppleScript Editor’s libraries (Window -> Library); if you don’t see the program you want, click the + (plus sign) in the top of the Library window and select the program from your Applications folder.
For instance, for my e-mail client Mailsmith, I added one command that changes the property of auto checking (set auto checking enabled to true) and another to add the check mail. Similarly with iChat: log in is a simple command, while set status message to 'Working' is only slightly more complicated.
You can script any application to activate itself first thing in the morning. True, you could add them to a list of Login Items for your user account in System Preferences’ Accounts pane. But I like the finer control over when and how they launch that I get from AppleScript.
This script might save me just a tiny sliver of time each day. But I suspect that, over over several years, it adds up to tens of hours when I don’t have to be a robot.
I recently attended the awesome SANS DFIR, Mac and iOS Forensics and Incident Response course with Sarah Edwards. This has obviously given me lots of great inspiration on how to negotiate Mac analysis in general and to take a closer look at some of those system files that we covered in training.
I’ve spent a little bit of time digging through the log files on my MacBook (Mojave 10.14.2). I’m sure this isn’t new to most practised Unix beards but for those who aren’t aware, there’s a really great little log file called daily.out in /var/log. I had previously given little credence to this log but realised it can be used to determine a whole wealth of useful information. I also reviewed the weekly.out and monthly.out files but these were, in my case, far less granular.
At a high level daily.out contains information relating to disk usage and networking, this file is written at least daily and the configurations for all three of the periodic logs are stored in plist files in the following location:
/System/Library/LaunchDaemons/com.apple.periodic-*****.plist
After reviewing the content of this file, it made me consider how this might assist in some of my casework?
Disk Usage
Firstly, I borrowed some grep skills from a very knowledgeable and tall colleague on my team to see if we could parse out just some specific information from the daily.out file. We extracted the lines only containing the dates, followed by the lines which related specifically to disk usage.
From this, we were able to find entries dating back as early as 3 months, and that the log contains:
- Logical volumes mounted at the time entries are written
- Size of volumes
- Space used on volumes
As you can imagine, disk volume information will be highly valuable in showing drives or images which were attached when the log was written and especially if you know the volume name used by a device you’re looking to prove access to.
We can also ascertain some other information from this log which is quite valuable.
Bootcamp!
You may have an instance where a suspect, subject or general bad person is saying they have never used their Bootcamp install, however, you can see from the Bootcamp disk usage that the volume is being written to and from regularly. Perhaps a big chunk of data has been deleted before a date of interest?
Uptime
Another interesting piece from the daily.out file is that it will show uptime of the system when the log entries are written. This could help prove whether or not the system was switched on and in use over a specific period.
This may also show some interesting information about account usage on the computer. As Mac computers generally tend to be used by individuals, this means there’s usually only ever one account logged on at any time. If you have an experienced user who is elevating to root every day, then seeing multiple accounts logged on may not be uncommon. Although, if an inexperienced user who has no knowledge of the root account, is logged on many times when another account is logged on, it may be suspicious or warrant further analysis.
Again, we extracted the lines from the daily.out file we are interested in using a simple grep command:
As you can see we can pull some interesting information about computer and account usage:
Dailies Mac Os Update
- Shows uptime of the system at the point in which the daily.out entry is written
- Also shows the number of users logged on, remember this is usually going to be one
Dailies Osrs
There are also some very useful network interface statistics listed in this file which are probably more relevant to IR investigations but we may look at these another time.
Daily Macros Needed
Reference: