Listing all known deleted OS X accounts

Question

Where can I find Applescript code or a PList to get deleted usernames as known to the OS itself, regardless of the file system's deletions?

Having to depend on folder hierarchies and backup disk images provided by the OS isn't a good way of doing forensic analysis. Those can easily be destroyed.

Answer 1

Mac OS X does not keep a list or database of deleted accounts. When you delete an account, the entry for that account is deleted from Open Directory's data store.

Answer 2

Regardless of other answers, I found this bash solution some time ago:

defaults read /Library/Preferences/com.apple.preferences.accounts deletedUsers

Gives one account name for every user removed from the system, in this format. It doesn't matter how long ago it was removed as long as the com.apple.preferences.accounts.plist file itself is not tampered with:

(
 {
    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Account name";
    "dsAttrTypeStandard:UniqueID" = 501;
    name = deletedusername;
 },

 {
    date = 9999-99-99 00:00:00 -0000;
    "dsAttrTypeStandard:RealName" = "Another name";
    "dsAttrTypeStandard:UniqueID" = 502;
    name = deletedothername;
 }

)