Evidence: Keyboard Dictionary
Description: Collects the list of words in the keyboard dictionary
Category: System
Platform: macos
Short Name: keydict
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Keyboard dictionary entries contain user-added words for autocorrect. This data is essential for profiling user terminology and contextualizing typed content.
Data Collected
This collector gathers structured data about keyboard dictionary.
Collection Method
This collector reads each user's LocalDictionary file and records entries into keyboard_dictionary.
Forensic Value
This evidence is crucial for forensic investigations as it can indicate custom vocabulary relevant to the case and user behavior.
