Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where can I find Applescript code or a PList to get deleted usernames as known to the OS itself, regardless of the file system's deletions?

Having to depend on folder hierarchies and backup disk images provided by the OS isn't a good way of doing forensic analysis. Those can easily be destroyed.

share|improve this question

Mac OS X does not keep a list or database of deleted accounts. When you delete an account, the entry for that account is deleted from Open Directory's data store.

share|improve this answer
There is absolutely no way to do this. Even if you find files that used to belong to a now delete user, you'll only get their former numeric user ID; you cannot rely on verbose log files containing user names, etc. – Daniel Beck Jul 23 '11 at 18:13
up vote 0 down vote accepted

Regardless of other answers, I found this bash solution some time ago:

defaults read /Library/Preferences/ deletedUsers

Gives one account name for every user removed from the system, in this format. It doesn't matter how long ago it was removed as long as the file itself is not tampered with:

    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Account name";
    "dsAttrTypeStandard:UniqueID" = 501;
    name = deletedusername;

    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Another name";
    "dsAttrTypeStandard:UniqueID" = 502;
    name = deletedothername;

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .