Dock Plist (Application Arrangement)

Location

Description

Per-user property list storing the Dock configuration including pinned applications, recent applications, minimized windows, persistent and recent document stacks, and the arrangement order. Each entry contains a file-data bookmark referencing the application or file path.

Forensic Value

The Dock plist records which applications a user has pinned and which were recently used, providing insight into the user activity profile and installed software. Recent applications in the Dock that do not match installed software may indicate execution of portable or attacker-deployed tools. The persistent-others array reveals folders and files the user keeps accessible, which may include network share shortcuts or frequently accessed sensitive directories. Changes to the Dock configuration correlated with the compromise timeline can indicate attacker interaction with the system GUI.

Tools Required