macOS Forensics: Applications TryHackMe.
When was Microsoft 365 and Office installed on the disk image in the attached VM? Format in GMT YYYY-MM-DD hh:mm:ss
2025–04–26 06:41:43
What is the name of the package used to install Microsoft Word?
Microsoft_Word_Internal.pkg
What arguments does the Microsoft update agent launch with? Format “Argument 1”, “Argument 2”
“/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant”, “ — launchByAgent”
Which application has Full Disk Access permissions?
com.apple.Terminal
What is the email address of the user using this machine?
A call was made using FaceTime on 2025–04–26 05:40:04. Was this call answered? Y/N
N
The user received a message on 2025–04–26 05:38:20. This message contained an image as an attachment. What animal is present in that image?
Dog
On what date and time was the previous message read? Format YYYY-MM-DD hh:mm:ss
2025–04–26 05:38:23
Get Muhammad Faizan’s stories in your inbox
Join Medium for free to get updates from this writer.
The user received a calendar invite in the mail from someone. What date is the calendar invite for? Format YYYY-MM-DD hh:mm:ss
2025–04–27 11:00:00
What was the timezone of the sender of the email invite? Format: GMT+XX:XX
GMT+03:00
The user’s calendar has another entry named “Jungle cruise”. When is this event going to start? Format in GMT YYYY-MM-DD hh:mm:ss
2025–04–25 16:00:00
The user saved two notes. Both have the same title. What is the title?
Aquickbrownfoxjumpedoverthelazydog
One of the notes has an attachment we already viewed while analysing iMessage. What animal is present in the other attachment?
Giraffe
The user has saved a reminder that has not been completed yet. What is the due date of this reminder? Format in GMT YYYY-MM-DD hh:mm:ss
2025–04–26 21:00:00
What is the complete path of the last file opened using Microsoft Word?
/Users/umair-thm/Downloads/Report-final-updated.pdf
The user seems to be a fan of TryHackMe. What is the URL of the THM room the user visited using Safari?
https://tryhackme.com/room/macosforensicsartefacts
When using APOLLO queries to parse passes, to what should we change the field PAYMENT_TRANSACTION.PASS_PID on newer macOS versions?
PAYMENT_TRANSACTION.PID
Thanks And Follow ME.
