Apple Remote Desktop (sometime abbreviated ARD) allows users to control or monitor another computer over a network or internet connection.
You can use the MacForensicsLab's Analyze function to explore the following file: ~/Library/Preferences/com.apple.RemoteDesktop.plist This file shows all the machines this Mac has had control of or viewed with Apple Remote Desktop. This file also includes information about the connection such as, the machine's MAC address, IP, name, and the time and date. This file also stores information that could have other forensic interest. It can also store saved tasks for Apple Remote Desktop. You can find more information on stored task data here.
