mac_get_user_accounts
Retrieve user accounts from a macOS triage collection, including deleted user accounts, for forensic investigations.
Instructions
Get user accounts from a triage collection, including deleted users.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| artifacts_dir | Yes | Path to triage collection root | |
| include_deleted | No | Include deleted user accounts |