Mac OS X makes connecting to remote servers very easy. Retrieving information about servers a suspect has connected to will help an investigator find other resources they should be investigating or to prove intent. Mac OS X logs these connections along with other information that may be of interest to an investigator.
You can use the MacForensicsLab Analyze function explore the following file: ~/Library/Preferences/com.apple.finder.plist Within that file you will find "FXConnectToLastURL". This entry shows the last file servers your suspect connected to. The entry "CFURLAliasData" will have the names of file servers accessed, disk images mounted, and sometimes names of DVDs (although they seem to be Apple authored only) that have been mounted on within the Finder. The entry "recent-folders" will show the last batch of folders that were accessed.
