Property List (Plist)
Definition
Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login items, malware persistence.
- Formats
- XML plist or binary plist (bplist00 magic)
- Common tools
- plutil, plistutil, mac_apt
- Typical content
- Preferences, recent items, login items
- Forensic use
- Malware persistence, user activity reconstruction
Common questions
How does an examiner tell a binary plist from an XML plist before parsing?+
A binary plist starts with the eight-byte magic signature bplist00, visible in a hex viewer, while an XML plist opens with a standard XML declaration and DOCTYPE, so the file header alone identifies which parser to use.
Why are plist files a common location for malware persistence on macOS?+
LaunchAgents and LaunchDaemons are configured through plist files that macOS reads at login or boot, so malware that writes an entry there gets re-executed automatically, making these plists a standard artefact to check during an intrusion investigation.
Related terms
- APFS
- Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes...
- Keychain
- Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the...
- Launchd
- macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and...
- Time Machine
- Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and...
- Unified Logging
- macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of...