Mac OS X Forensics
Never give up, the answer is right in front of you...
-
Our Sponsors
-
Custom Search
Using the Mac
OS Native Screen Capture Ability
-Dave Melvin
In preparing for podcasts & teaching classes, such as Mac forensics, I do a lot of screenshots. While I have Snap Pro Z, I tend to use the native Mac OS screen capture ability. The Mac allows you to capture the entire desktop, an open window, or a specific, designated area.
When you take a screenshot, the images are saved to the desktop as PNG files. Now, in Leopard and prior versions of the OS, each PNG used the naming convention of “Picture” . Any additional screenshots will be given a number in sequential order (i.e. Picture 1, Picture 2, etc).
With Snow Leopard, this changes for the better, at least I think so! The naming conventions that is used in SL is “Screenshot” and the date/time group of when it was taken. This makes it easy to segregate images and not have to worry about having four Picture 3.png files, making you search for the one you wanted.
Snow Leopard Sample Screen Capture - New Naming Convention
Leopard Sample Screen Capture - Original Naming Conventiion
Now, I can take a ton of screenshots while preparing for a class. This really clutters up my desktop. After getting tired of this, I decided to change the location of where my screenshot would be saved. It is fairly simple to do this using the Terminal.
First, create a folder on where you want to save your screenshots. For ease, I created a “screenshot” folder on my desktop.
Open up the Terminal, and type the following command:
defaults write com.apple.screencapture location
Terminal - Command line to change default Screen Capture location
Remember, all you have to do to populate the folder location in the command is to Drag the folder and drop it on the Terminal. Once you have the command typed, hit the return key.
Then type the command:
killall SystemUIServer
Terminal - Command line to restart to user interface, force changes to take effect
Once you click on the return key, this will kill and restart the service and the new location will be set. Test it to make sure that it worked!
Finder Window - Showing new default location for Screen Captures
The following are the screenshot key sequences:
Using the Control key in conjunction with with the above commands will copy the screenshot to the clipboard, it than can be pasted to wherever you would like.
You can also use the application, Grab, which is located in the Utilities folder. Grab takes screen shots using a few different key strokes to include a timed shot. Grab also allows you to save the screenshot with any name you would like. The file is saved as a TIFF. You can change this by exercising the same Terminal line command techniques as above with the following syntax:
Be sure to follow the command with 'killall SystemUIServer' to force the changes to take effect.
-Dave Melvin
In preparing for podcasts & teaching classes, such as Mac forensics, I do a lot of screenshots. While I have Snap Pro Z, I tend to use the native Mac OS screen capture ability. The Mac allows you to capture the entire desktop, an open window, or a specific, designated area.
Sponsored Advertisement
When you take a screenshot, the images are saved to the desktop as PNG files. Now, in Leopard and prior versions of the OS, each PNG used the naming convention of “Picture” . Any additional screenshots will be given a number in sequential order (i.e. Picture 1, Picture 2, etc).
With Snow Leopard, this changes for the better, at least I think so! The naming conventions that is used in SL is “Screenshot” and the date/time group of when it was taken. This makes it easy to segregate images and not have to worry about having four Picture 3.png files, making you search for the one you wanted.
Snow Leopard Sample Screen Capture - New Naming Convention
Leopard Sample Screen Capture - Original Naming Conventiion
Now, I can take a ton of screenshots while preparing for a class. This really clutters up my desktop. After getting tired of this, I decided to change the location of where my screenshot would be saved. It is fairly simple to do this using the Terminal.
First, create a folder on where you want to save your screenshots. For ease, I created a “screenshot” folder on my desktop.
Open up the Terminal, and type the following command:
defaults write com.apple.screencapture location
Terminal - Command line to change default Screen Capture location
Remember, all you have to do to populate the folder location in the command is to Drag the folder and drop it on the Terminal. Once you have the command typed, hit the return key.
Then type the command:
killall SystemUIServer
Terminal - Command line to restart to user interface, force changes to take effect
Once you click on the return key, this will kill and restart the service and the new location will be set. Test it to make sure that it worked!
Finder Window - Showing new default location for Screen Captures
The following are the screenshot key sequences:
- Command-Shift-3: Take a screenshot of the entire desktop
- Command-Shift-4: Allows the selection of a specific area
- Command-Shift-4-Spacebar: Allows the taking of a screenshot of a selected window
- Command-Control-Shift-3: Take a screenshot of the screen, and save it to the clipboard
Using the Control key in conjunction with with the above commands will copy the screenshot to the clipboard, it than can be pasted to wherever you would like.
You can also use the application, Grab, which is located in the Utilities folder. Grab takes screen shots using a few different key strokes to include a timed shot. Grab also allows you to save the screenshot with any name you would like. The file is saved as a TIFF. You can change this by exercising the same Terminal line command techniques as above with the following syntax:
- defaults write com.apple.screencapture type png
- defaults write com.apple.screencapture type pdf
- defaults write com.apple.screencapture type jpg
- defaults write com.apple.screencapture type tif
- defaults write com.apple.screencapture type psd
Be sure to follow the command with 'killall SystemUIServer' to force the changes to take effect.