SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch") as LSQuarantineTimeStamp, LSQuarantineAgentName, LSQuarantineOriginURLString, LSQuarantineDataURLString from LSQuarantineEvent Users/$USERNAME/Library/Internet Plug-Ins spinĭiagnostic Reports /Library/Logs/DiagnosticReports These directories contain Property list (plist) files.Ĭrash Reporter /Library/Application Support/CrashReporterĬontains text files named. private/var/.logs_exporter/cache/Users/$USERNAME/Library/Logs/DiscRecording.log
Users/$USERNAME/Library/Logs/DiscRecording.log Users/$USERNAME/Library/Preferences/Īctual burning of optical media is logged in: These alias files contain additional date and time values.Īlso check the following files for references to deleted. This folder normally contains alias files (similar to LNK files under Windows). Sparse bundle disk image (.sparsebundle).read-write disk image (.dmg), which can be stored in Raw Image Format or Universal Disk Image Format (UDIF).
#OS X DATABASE MAC OS X#
Mac OS X has support for various disk image types built-in, some of which are: The behavior of the bootloader can be configured in the which can be found in: The bootloader can be eithe a MZ-PE/COFF or EFI fat binary type executables and is commonly stored in:
#OS X DATABASE DRIVER#
The bootloader displays a dark grey Apple logo on the screen and loads the Darwin kernel from disk, as well as the essential driver extensions. The firmware starts the Mac OS X boot loader (boot.efi). Though it is not clear which header field the source is referring to but likely related to the "bless" utility. According to HFS+ volume header fields are used to point to a "blessed file" to be loaded as an EFI application. Mac OS X extends EFI with a read-only HFS+ driver. to print all of the firmware variables.Īdditional boot arguments can be provided via the "boot-args" value. The default boot volume is stored in NVRAM and can be configured through the "Startup Disk" preference pane or the nvram command line utility.
The firmware is responsible for initializing the hardware and performing a POST (Power-On Self Test).