Login Items

Overview

Evidence: Login Items Description: Collect Login Items Category: System Platform: macos Short Name: litms Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Login Items configure applications to start automatically upon user login. This data is essential for detecting persistence and unwanted auto-start programs.

Data Collected

This collector gathers structured data about login items.

Login Items Data

Field	Description	Example
Item	Item	Example value
Path	Path	Example value
Active	Active	true

Collection Method

This collector uses AppleScript via osascript to enumerate login items and their paths, recording them into login_items.

Forensic Value

This evidence is crucial for forensic investigations as it reveals user-level persistence and startup behavior.