Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Where can I find Applescript code or a PList to get deleted usernames as known to the OS itself, regardless of the file system's deletions?

Having to depend on folder hierarchies and backup disk images provided by the OS isn't a good way of doing forensic analysis. Those can easily be destroyed.

share|improve this question
add comment

2 Answers

Mac OS X does not keep a list or database of deleted accounts. When you delete an account, the entry for that account is deleted from Open Directory's data store.

share|improve this answer
    
There is absolutely no way to do this. Even if you find files that used to belong to a now delete user, you'll only get their former numeric user ID; you cannot rely on verbose log files containing user names, etc. –  Daniel Beck Jul 23 '11 at 18:13
add comment
up vote 0 down vote accepted

Regardless of other answers, I found this bash solution some time ago:

defaults read /Library/Preferences/com.apple.preferences.accounts deletedUsers

Gives one account name for every user removed from the system, in this format. It doesn't matter how long ago it was removed as long as the com.apple.preferences.accounts.plist file itself is not tampered with:

(
 {
    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Account name";
    "dsAttrTypeStandard:UniqueID" = 501;
    name = deletedusername;
 },

 {
    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Another name";
    "dsAttrTypeStandard:UniqueID" = 502;
    name = deletedothername;
 }

)
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.