OS X preference files contain traces of the Tor Browser Bundle
A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit) on OS X 10.8 showed that the preference files contain traces of the Tor Browser Bundle.
OS X applications store preference settings in plist files, and the files below are related to system fonts, the file manager, recent items, and the Tor Browser Bundle. These files contain traces of the Tor Browser Bundle and the attached external drive.
- /Users/runa/Library/Preferences/com.apple.ATS.plist
- /Users/runa/Library/Preferences/com.apple.finder.plist
- /Users/runa/Library/Preferences/com.apple.recentitems.plist
- /Users/runa/Library/Preferences/org.mozilla.torbrowser.plist