Function ParseUsersAccounts

osxauditor.py:1149–1185

Parse users' accounts

()

        PrintAndLog(Admins, 'INFO_RAW')

def ParseUsersAccounts():
    ''' Parse users' accounts '''

    PrintAndLog(u'Users\' accounts', 'SECTION')

    PrintAndLog(u'Users\' social accounts', 'SUBSECTION')
    for User in os.listdir(os.path.join(ROOT_PATH, 'Users')):
        UsersAccountPath = os.path.join(ROOT_PATH, 'Users', User, 'Library/Accounts/Accounts3.sqlite')
        if User[0] != '.':
            PrintAndLog(User + u'\'s social account', 'SUBSECTION')
            if os.path.isfile(UsersAccountPath):
                DumpSQLiteDb(UsersAccountPath)
            else:
                PrintAndLog(User + u' has no social account', 'INFO')

    PrintAndLog(u'Users\' Mail.app accounts', 'SUBSECTION')
    for User in os.listdir(os.path.join(ROOT_PATH, 'Users')):
        MailAccountPlistPath = os.path.join(ROOT_PATH, 'Users', User, 'Library/Containers/com.apple.mail/Data/Library/Mail/V2/MailData/Accounts.plist')
        if User[0] != '.':
            PrintAndLog(User + u'\'s Mail.app accounts', 'SUBSECTION')
            if os.path.isfile(MailAccountPlistPath):
                ParseMailAppAccount(MailAccountPlistPath)
            else:
                PrintAndLog(User + u' has no Mail.app account', 'INFO')

    PrintAndLog(u'Users\' recent items', 'SUBSECTION')
    for User in os.listdir(os.path.join(ROOT_PATH, 'Users')):
        RecentItemsAccountPlistPath = os.path.join(ROOT_PATH, 'Users', User, 'Library/Preferences/com.apple.recentitems.plist')
        if User[0] != '.':
            PrintAndLog(User + u'\'s recent items', 'SUBSECTION')
            if os.path.isfile(RecentItemsAccountPlistPath):
                ParseUsersRecentItems(RecentItemsAccountPlistPath)
            else:
                PrintAndLog(User + u' has no recent items', 'INFO')

    ParseSysAdminsGroup()
    ParseSysUsers()

def ParseInstalledApps():
    ''' Parses and hashes installed apps in /Applications '''