OS X Crash Reporter and Diagnostic Messages contain traces of the Tor Browser Bundle
A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit) on OS X 10.8 showed that the Crash Reporter and Diagnostic Messages contain traces of the Tor Browser Bundle, even though the bundle did not crash or hang while I used it:
- /Library/Application Support/CrashReporter/Intervals_00000000-0000-1000-8000-000C2976590B.plist
- /var/log/DiagnosticMessages/2013.05.22.asl
I have not been able to open the file StoreData, which can be found in the same DiagnosticMessages directory, but it may also contain traces of the bundle.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information