iChat is an AIM (AOL Instant Messenger) client and comes built-in to Mac OS X. It is popular with many Mac OS X users as it has an easy to use interface, it works with AIM, and it's well integrated into the operating system. Finding the usernames of a suspect may be of use to the investigator.
You can use the MacForensicsLab analyze function to explore the following file: ~/Library/Preferences/com.apple.iChat.AIM.plist This file contains all the AIM iChat accounts used on the suspect machine. Multiple accounts are shown if your suspect has been using more than one account. The passwords for these accounts are contained in the Apple keychain. If this file is unlocked (normal setup) you can login and find out who your suspect has been talking to.
