DMG File Opened

Overview

Evidence: DMG File Opened Description: Collects previously opened DMG files. Category: DiskFilesystem Platform: macos Short Name: dmgf Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

DMG (disk image) files are commonly used on macOS for software distribution and data storage. When a DMG file is opened, macOS stores extended attributes (xattrs) including fsck information and recent checksums on the file. These attributes provide forensic evidence of DMG file access, helping investigators identify software installations, data transfers, or malicious payloads delivered via DMG files.

Data Collected

This collector gathers structured data about dmg file opened.

DMG File Opened Data

Field	Description	Example
ID	ID	123
Path	Path	Example value
Username	Username	Example value
Fsck	Fsck	Example value
RecentCksumDate	Recent Cksum Date	2023-10-15 14:30:25+03:00
RecentCksumType	Recent Cksum Type	Example value
RecentCksum	Recent Cksum	Example value

Collection Method

This collector scans the file system for DMG files and extracts extended attributes (com.apple.diskimages.fsck and com.apple.diskimages.recentcksum) to identify which DMG files were previously opened. It parses the recentcksum attribute to extract timestamps, checksum types, and checksum values, providing a timeline of DMG file access.

Forensic Value

DMG file access history is valuable for identifying software installations, detecting unauthorized application deployments, tracking malware delivery mechanisms, and establishing file access timelines. The checksum information can be used to verify file integrity and correlate DMG files across multiple systems. This evidence is particularly useful for detecting supply chain attacks, insider threats, and unauthorized software installations.