OS X Crash Reporter and Diagnostic Messages contain traces of the Tor Browser Bundle
A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit) on OS X 10.8 showed that the Crash Reporter and Diagnostic Messages contain traces of the Tor Browser Bundle, even though the bundle did not crash or hang while I used it:
- /Library/Application Support/CrashReporter/Intervals_00000000-0000-1000-8000-000C2976590B.plist
- /var/log/DiagnosticMessages/2013.05.22.asl
I have not been able to open the file StoreData, which can be found in the same DiagnosticMessages directory, but it may also contain traces of the bundle.