Changes on First Boot

From radmind wiki

Jump to: navigation, search

These are all referenced from a set of experiments done with a clean install of 10.5.0 followed by the 10.5.7 combo updater on an unbooted partition, followed by one boot.

fsdiff does not differentiate in its output between changed and newly created files, so a python script was used to detect files created on boot.

The negative and exclude used were essentially those from this wiki

Contents

All changes after first boot without any filtering by negatives or excludes

f ./.fseventsd/000000008107a389        	0600     0    80 1242423325     430 -
f ./.fseventsd/000000008107b89d        	0600     0    80 1242423712    1839 -
f ./.fseventsd/000000008107db80        	0600     0    80 1242423752       0 -
f ./.fseventsd/fseventsd-uuid          	0600     0    80 1242423712      36 -
a ./.hotfiles.btree                    	0600     0     0 1242423341  262238 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/.store.db	0644     0    80 1242423788 3379200 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexArrays	0600     0    80 1242423614 2389624 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexCompactDirectory	0600     0    80 1242423614  298090 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexDirectory	0600     0    80 1242423614   50372 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexGroups	0600     0    80 1242423569   87382 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexHead	0600     0    80 1242423788    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexIds	0600     0    80 1242423569 1048576 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexPositions	0600     0    80 1242423614  805263 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexPostings	0600     0    80 1242423614 2496489 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.indexUpdates	0600     0    80 1242423612       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.shadowIndexGroups	0600     0    80 1242423788   66675 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/0.shadowIndexHead	0600     0    80 1242423788    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/indexState	0600     0    80 1242423788      28 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/journalExclusion	0600     0    80 1242423387       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/journalLive	0600     0    80 1242423788       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/journalSync	0600     0    80 1242423788       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexArrays	0600     0    80 1242423752   65536 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexCompactDirectory	0600     0    80 1242423752    1024 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexDirectory	0600     0    80 1242423752    8224 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexGroups	0600     0    80 1242423752    2731 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexHead	0600     0    80 1242423788    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexIds	0600     0    80 1242423752   32768 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexPositions	0600     0    80 1242423752    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexPositionTable	0600     0    80 1242423752    8192 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexPostings	0600     0    80 1242423787    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexTermIds	0600     0    80 1242423752    8192 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.indexUpdates	0600     0    80 1242423788       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexArrays	0600     0    80 1242423788   65536 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexCompactDirectory	0600     0    80 1242423788       8 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexDirectory	0600     0    80 1242423788    2056 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexGroups	0600     0    80 1242423788      58 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexHead	0600     0    80 1242423788    4096 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexPositionTable	0600     0    80 1242423612       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.0.shadowIndexTermIds	0600     0    80 1242423788    3040 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexArrays	0600     0    80 1242422109   65536 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexCompactDirectory	0600     0    80 1242422109    1024 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexDirectory	0600     0    80 1242422109    8224 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexGroups	0600     0    80 1242422108    2731 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexHead	0600     0    80 1242422109    4096 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexIds	0600     0    80 1242422108   32768 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexPositions	0600     0    80 1242422109    4096 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexPositionTable	0600     0    80 1242422109    8192 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexPostings	0600     0    80 1242422109    4096 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexTermIds	0600     0    80 1242422109    8192 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.indexUpdates	0600     0    80 1242422109       0 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexArrays	0600     0    80 1242422109   65536 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexCompactDirectory	0600     0    80 1242422109       8 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexDirectory	0600     0    80 1242422109    2056 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexGroups	0600     0    80 1242422109       1 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexHead	0600     0    80 1242422109    4096 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexPositionTable	0600     0    80 1242422109       0 -
- f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/live.1.shadowIndexTermIds	0600     0    80 1242422109       0 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/store.db	0644     0    80 1242423788 3379200 -
f ./.Spotlight-V100/Store-V1/Stores/9D59F8E6-39DE-4C90-8661-D2A846486FE0/store.updates	0600     0    80 1242423788       4 -
d ./home                               	0555     0    80
f ./Library/Caches/com.apple.Components2.LocalCache.AudioComponents	0644     0    80 1242418197       0 -
f ./Library/Caches/com.apple.Components2.LocalCache.Components	0644     0    80 1242418494       0 -
f ./Library/Caches/com.apple.Components2.LocalCache.QuickTimeComponents	0644     0    80 1190613685       0 -
f ./Library/Caches/com.apple.LaunchServices-0230.csstore	0644     0    80 1242423602  561152 -
a ./Library/ColorSync/Profiles/Displays/Color\bLCD-42717C0.icc	0644     0    80 1242423388    4010 -
f ./Library/Keychains/.fl947E1BDB      	0444     0    80 1242423371       0 -
f ./Library/Keychains/System.keychain  	0644     0    80 1242423376   29476 -
d ./Library/Logs/DirectoryService      	0775     0    80
f ./Library/Logs/DirectoryService/DirectoryService.server.log	0644     0    80 1242423713    2509 -
f ./Library/Logs/SingleSignOnTools.log 	0644     0    80 1242423379      73 -
f ./Library/Preferences/.GlobalPreferences.plist	0644     0    80 1242423388     459 -
f ./Library/Preferences/com.apple.alf.plist	0644     0    80 1242423360    1822 -
f ./Library/Preferences/com.apple.AppleFileServer.plist	0644     0    80 1242423380     180 -
f ./Library/Preferences/com.apple.BezelServices.plist	0644     0    80 1242423711     515 -
f ./Library/Preferences/com.apple.Bluetooth.plist	0644     0    80 1242423390     906 -
f ./Library/Preferences/com.apple.CoreRAIDServer.cfdb	0664     0    80 1242423370      60 -
f ./Library/Preferences/com.apple.driver.AppleIRController.plist	0644     0    80 1242423393      80 -
f ./Library/Preferences/com.apple.HIToolbox.plist	0644     0    80 1242423397     216 -
f ./Library/Preferences/com.apple.loginwindow.plist	0644     0    80 1242423711      63 -
f ./Library/Preferences/com.apple.security.systemidentities.plist	0644     0    80 1242423376     353 -
f ./Library/Preferences/DirectoryService/ContactsNodeConfig.plist	0600     0    80 1242423377     430 -
f ./Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist	0600     0    80 1242423377     324 -
f ./Library/Preferences/DirectoryService/DirectoryService.plist	0600     0    80 1242423357     374 -
f ./Library/Preferences/DirectoryService/DirectoryServiceDebug.plist	0600     0    80 1242423357     507 -
f ./Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist	0600     0    80 1242423358     455 -
f ./Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist	0644     0    80 1242423357     249 -
f ./Library/Preferences/DirectoryService/SearchNodeConfig.plist	0600     0    80 1242423376     430 -
f ./Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist	0600     0    80 1242423376     324 -
f ./Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist	0644     0     0 1242423386     230 -
f ./Library/Preferences/SystemConfiguration/com.apple.network.identification.plist	0644     0     0 1242423712    1313 -
f ./Library/Preferences/SystemConfiguration/com.apple.smb.server.plist	0644     0    80 1242423399     386 -
f ./Library/Preferences/SystemConfiguration/NetworkInterfaces.plist	0644     0     0 1242423375    1894 -
f ./Library/Preferences/SystemConfiguration/preferences.plist	0644     0     0 1242423384    7505 -
d ./net                                	0555     0    80
f ./private/etc/authorization          	0644     0     0 1242423371   20842 -
- d ./private/etc/com.apple.su.startup   	0755     0     0
- f ./private/etc/com.apple.su.startup/auth_sys_print_admin	0755     0     0 1242418484   23344 -
- f ./private/etc/com.apple.su.startup/su.startup	0755     0     0 1242418484     415 -
f ./private/etc/krb5.keytab            	0600     0     0 1242423387    1319 -
f ./private/etc/memberd.conf           	0755     0     0 1242423357     124 -
f ./private/var/db/.AutoBindDone       	0644     0     0 1242423386       0 -
f ./private/var/db/.com.apple.iokit.graphics	0644     0     0 1242423387     333 -
f ./private/var/db/BootCache.playlist  	0600     0     0 1242423401   47112 -
f ./private/var/db/CodeEquivalenceDatabase	0644     0     0 1242423401   16384 -
f ./private/var/db/crls/.fl12663120    	0444     0     0 1242423434       0 -
f ./private/var/db/crls/crlcache.db    	0644     0     0 1242423434   14116 -
d ./private/var/db/dhcpclient          	0700     0     0
d ./private/var/db/dhcpclient/leases   	0700     0     0
f ./private/var/db/dhcpclient/leases/en0-1,0:19:e3:44:6c:6a	0644     0     0 1242423712    1007 -
d ./private/var/db/DirectoryService    	0750     0     0
f ./private/var/db/DirectoryService/flatfile.db	0644     0     0 1242423366 1447936 -
d ./private/var/db/dslocal/indices     	0755     0     0
d ./private/var/db/dslocal/indices/Default	0700     0     0
f ./private/var/db/dslocal/indices/Default/index	0644     0     0 1242423407   57344 -
d ./private/var/db/dslocal/nodes/Default/config	0700     0     0
f ./private/var/db/dslocal/nodes/Default/config/KerberosKDC.plist	0600     0     0 1242423376    1215 -
f ./private/var/db/dslocal/nodes/Default/config/SharePoints.plist	0600     0     0 1242423712     255 -
f ./private/var/db/dslocal/nodes/Default/groups/_amavisd.plist	0600     0     0 1242423406     647 -
f ./private/var/db/dslocal/nodes/Default/groups/_appserveradm.plist	0600     0     0 1242423405     653 -
f ./private/var/db/dslocal/nodes/Default/groups/_appserverusr.plist	0600     0     0 1242423405     654 -
f ./private/var/db/dslocal/nodes/Default/groups/_clamav.plist	0600     0     0 1242423405     677 -
f ./private/var/db/dslocal/nodes/Default/groups/_jabber.plist	0600     0     0 1242423406     641 -
f ./private/var/db/dslocal/nodes/Default/groups/_lp.plist	0600     0     0 1242423404     631 -
f ./private/var/db/dslocal/nodes/Default/groups/_lpadmin.plist	0600     0     0 1242423368     575 -
f ./private/var/db/dslocal/nodes/Default/groups/_mailman.plist	0600     0     0 1242423405     638 -
f ./private/var/db/dslocal/nodes/Default/groups/_mysql.plist	0600     0     0 1242423405     633 -
f ./private/var/db/dslocal/nodes/Default/groups/_postdrop.plist	0600     0     0 1242423404     645 -
f ./private/var/db/dslocal/nodes/Default/groups/_postfix.plist	0600     0     0 1242423404     642 -
f ./private/var/db/dslocal/nodes/Default/groups/_qtss.plist	0600     0     0 1242423405     639 -
f ./private/var/db/dslocal/nodes/Default/groups/_sshd.plist	0600     0     0 1242423405     629 -
f ./private/var/db/dslocal/nodes/Default/groups/_unknown.plist	0600     0     0 1242423407     632 -
f ./private/var/db/dslocal/nodes/Default/groups/_uucp.plist	0600     0     0 1242423404     560 -
f ./private/var/db/dslocal/nodes/Default/groups/_www.plist	0600     0     0 1242423405     628 -
f ./private/var/db/dslocal/nodes/Default/groups/accessibility.plist	0600     0     0 1242423407     623 -
f ./private/var/db/dslocal/nodes/Default/groups/admin.plist	0600     0     0 1242423405     671 -
f ./private/var/db/dslocal/nodes/Default/groups/authedusers.plist	0600     0     0 1242423399     654 -
f ./private/var/db/dslocal/nodes/Default/groups/bin.plist	0600     0     0 1242423404     599 -
f ./private/var/db/dslocal/nodes/Default/groups/consoleusers.plist	0600     0     0 1242423400     656 -
f ./private/var/db/dslocal/nodes/Default/groups/daemon.plist	0600     0     0 1242423403     665 -
f ./private/var/db/dslocal/nodes/Default/groups/dialer.plist	0600     0     0 1242423404     598 -
f ./private/var/db/dslocal/nodes/Default/groups/everyone.plist	0600     0     0 1242423398     639 -
f ./private/var/db/dslocal/nodes/Default/groups/group.plist	0600     0     0 1242423402     545 -
f ./private/var/db/dslocal/nodes/Default/groups/interactusers.plist	0600     0     0 1242423399     647 -
f ./private/var/db/dslocal/nodes/Default/groups/kmem.plist	0600     0     0 1242423403     668 -
f ./private/var/db/dslocal/nodes/Default/groups/mail.plist	0600     0     0 1242423403     603 -
f ./private/var/db/dslocal/nodes/Default/groups/netusers.plist	0600     0     0 1242423399     638 -
f ./private/var/db/dslocal/nodes/Default/groups/network.plist	0600     0     0 1242423404     618 -
f ./private/var/db/dslocal/nodes/Default/groups/nobody.plist	0600     0     0 1242423403     598 -
f ./private/var/db/dslocal/nodes/Default/groups/nogroup.plist	0600     0     0 1242423403     606 -
f ./private/var/db/dslocal/nodes/Default/groups/operator.plist	0600     0     0 1242423403     675 -
f ./private/var/db/dslocal/nodes/Default/groups/owner.plist	0600     0     0 1242423400     545 -
f ./private/var/db/dslocal/nodes/Default/groups/smmsp.plist	0600     0     0 1242423404     477 -
f ./private/var/db/dslocal/nodes/Default/groups/staff.plist	0600     0     0 1242423404     662 -
f ./private/var/db/dslocal/nodes/Default/groups/sys.plist	0600     0     0 1242423403     660 -
f ./private/var/db/dslocal/nodes/Default/groups/tty.plist	0600     0     0 1242423403     662 -
f ./private/var/db/dslocal/nodes/Default/groups/utmp.plist	0600     0     0 1242423404     535 -
f ./private/var/db/dslocal/nodes/Default/groups/wheel.plist	0600     0     0 1242423403     668 -
f ./private/var/db/dyld/dyld_shared_cache_i386	0644     0     0 1242423424 132526080 -
f ./private/var/db/dyld/dyld_shared_cache_i386.map	0644     0     0 1242423428   39510 -
- f ./private/var/db/InstallResults.plist	0644     0     0 1242418196     240 -
d ./private/var/db/krb5kdc             	0700     0     0
f ./private/var/db/krb5kdc/.k5.LKDC:SHA1.A7EDCC6EC9AE4EADE98E9A9313D6C941530BB0A2	0600     0     0 1242423377      30 -
f ./private/var/db/krb5kdc/kdc.conf    	0600     0     0 1242423376     839 -
f ./private/var/db/krb5kdc/principal.LKDC:SHA1.A7EDCC6EC9AE4EADE98E9A9313D6C941530BB0A2	0600     0     0 1242423386   16384 -
f ./private/var/db/krb5kdc/principal.LKDC:SHA1.A7EDCC6EC9AE4EADE98E9A9313D6C941530BB0A2.kadm5	0600     0     0 1242423377    8192 -
f ./private/var/db/krb5kdc/principal.LKDC:SHA1.A7EDCC6EC9AE4EADE98E9A9313D6C941530BB0A2.kadm5.lock	0600     0     0 1242423377       0 -
f ./private/var/db/krb5kdc/principal.LKDC:SHA1.A7EDCC6EC9AE4EADE98E9A9313D6C941530BB0A2.ok	0600     0     0 1242423402       0 -
d ./private/var/db/PanicReporter       	0775     0    80
f ./private/var/db/smb.conf            	0644     0     0 1242423399    1123 -
f ./private/var/db/statd.status        	0644     0     0 1242423351     256 -
f ./private/var/db/SystemEntropyCache  	0600     0     0 1242423355      20 -
d ./private/var/folders/zz             	0755     0     0
d ./private/var/folders/zz/zzzivhrRnAmviuee+++++++++++	0755     0     0
d ./private/var/folders/zz/zzzivhrRnAmviuee+++++++++++/-Caches-	0700     0     0
f ./private/var/folders/zz/zzzivhrRnAmviuee+++++++++++/-Caches-/seatbelt-cache.db	0644     0     0 1242423370   11264 -
d ./private/var/folders/zz/zzzivhrRnAmviuee++++EE+++22	0755    65    65
d ./private/var/folders/zz/zzzivhrRnAmviuee++++EE+++22/-Caches-	0700    65    65
f ./private/var/folders/zz/zzzivhrRnAmviuee++++EE+++22/-Caches-/seatbelt-cache.db	0644    65    65 1242423377   20480 -
d ./private/var/folders/zz/zzzivhrRnAmviuee++++EE+++22/-Tmp-	0700    65    65
d ./private/var/folders/zz/zzzivhrRnAmviuee++++KE+++3Y	0755    89    89
d ./private/var/folders/zz/zzzivhrRnAmviuee++++KE+++3Y/-Tmp-	0700    89    89
d ./private/var/folders/zz/zzzivhrRnAmviuee++++L++++3k	0755    92    92
d ./private/var/folders/zz/zzzivhrRnAmviuee++++L++++3k/-Caches-	0700    92    92
f ./private/var/folders/zz/zzzivhrRnAmviuee++++L++++3k/-Caches-/com.apple.IntlDataCache.le	0600    92    92 1242423555   11756 -
f ./private/var/folders/zz/zzzivhrRnAmviuee++++L++++3k/-Caches-/com.apple.IntlDataCache.le.kbdx	0600    92    92 1242423555  100788 -
f ./private/var/folders/zz/zzzivhrRnAmviuee++++L++++3k/-Caches-/com.apple.IntlDataCache.le.sbdl	0600    92    92 1242423403   19336 -
d ./private/var/folders/zz/zzzivhrRnAmviuee++++ME+++42	0755    97    97
d ./private/var/folders/zz/zzzivhrRnAmviuee++++ME+++42/-Caches-	0700    97    97
d ./private/var/folders/zz/zzzivhrRnAmviuee++++ME+++42/-Caches-/System	0755    97    97
f ./private/var/folders/zz/zzzivhrRnAmviuee++++ME+++42/-Caches-/System/annex_aux	0744    97    97 1242423396 7269132 -
f ./private/var/folders/zz/zzzivhrRnAmviuee++++ME+++42/-Caches-/System/font	0644    97    97 1242423397  155648 -
f ./private/var/log/alf.log            	0644     0     0 1242423348       0 -
d ./private/var/log/asl                	0755     0     0
f ./private/var/log/asl/2009.05.15.asl 	0644     0     0 1242423712   40610 -
f ./private/var/log/asl/2009.05.15.U0.asl	0600     0     0 1242423401    2431 -
f ./private/var/log/asl/2009.05.15.U0.G80.asl	0640     0    80 1242423708    6917 -
f ./private/var/log/asl/StoreData      	0644     0     0 1242423712       8 -
f ./private/var/log/asl/SweepStore     	0644     0     0 1242423355       0 -
f ./private/var/log/cups/access_log    	0644     0    26 1242423415     110 -
f ./private/var/log/cups/error_log     	0644     0    26 1242423712    1400 -
f ./private/var/log/fsck_hfs.log       	0644     0     0 1242423370     639 -
d ./private/var/log/krb5kdc            	0700     0     0
f ./private/var/log/krb5kdc/kadmin.log 	0600     0     0 1242423387     774 -
f ./private/var/log/secure.log         	0600     0    80 1242423712    6171 -
f ./private/var/log/system.log         	0644     0     0 1242423712   25449 -
f ./private/var/log/windowserver.log   	0640     0    80 1242423403    1392 -
d ./private/var/root/Library/Autosave\bInformation	0700     0     0
d ./private/var/root/Library/Preferences/ByHost	0700     0     0
f ./private/var/root/Library/Preferences/ByHost/.GlobalPreferences.0019e3446c6a.plist	0600     0     0 1242423388      96 -
f ./private/var/root/Library/Preferences/ByHost/com.apple.Bluetooth.0019e3446c6a.plist	0600     0     0 1242423391     467 -
f ./private/var/run/.DSRunningSP1      	0600     0     1 1242423387       0 -
- f ./private/var/run/.scratch           	0644     0     0 1190583453       0 -
f ./private/var/run/.systemStarterRunning	0644     0     1 1242423343       0 -
f ./private/var/run/appfwd.pid         	0644     0     1 1242423371       3 -
s ./private/var/run/asl_input          	0666     0     1
f ./private/var/run/automount.initialized	0600     0     1 1242423366       0 -
f ./private/var/run/com.apple.blued.launchd	0644     0     1 1242423362       0 -
f ./private/var/run/configd.pid        	0644     0     1 1242423351       3 -
d ./private/var/run/cups               	0755     0    26
d ./private/var/run/cups/certs         	0511    26    80
s ./private/var/run/cupsd              	0777     0     1
f ./private/var/run/diskarbitrationd.pid	0644     0     1 1242423352       3 -
f ./private/var/run/mach.sym           	0644     0     1 1242423379  721184 -
s ./private/var/run/mDNSResponder      	0666     0     1
d ./private/var/run/mds                	0700     0     1
f ./private/var/run/mds/uuid-tokenID.plist	0644     0     1 1242423387     483 -
f ./private/var/run/mds.pid            	0644     0     1 1242423367       3 -
s ./private/var/run/portmap.socket     	0700     0     1
s ./private/var/run/pppconfd           	0777     0     1
f ./private/var/run/resolv.conf        	0644     0     1 1242423392      92 -
s ./private/var/run/syslog             	0666     0     1
f ./private/var/run/syslog.pid         	0644     0     1 1242423350       3 -
s ./private/var/run/usbmuxd            	0777     0     1
f ./private/var/run/utmpx              	0644     0     1 1242423349    1256 -
s ./private/var/samba/winbindd_privileged/pipe	0600     0     0
s ./private/var/samba/winbindd_public/pipe	0666     0     0
f ./private/var/spool/cups/cache/job.cache	0644     0    26 1242423712      85 -
f ./private/var/spool/cups/cache/remote.cache	0644     0    26 1242423712      76 -
d ./private/var/spool/cups/cache/rss   	0775     0    26
d ./private/var/tmp/launchd            	0700     0     0
s ./private/var/tmp/launchd/sock       	0700     0     0
d ./private/var/tmp/mds/messages       	0755     0     0
f ./private/var/tmp/mds/system/.fl8E6EFC6C	0444     0     0 1242423356       0 -
f ./private/var/tmp/mds/system/.flCF600F4B	0444     0     0 1242423356       0 -
f ./private/var/tmp/mds/system/mds.lock	0644     0     0 1242423357       0 -
f ./private/var/tmp/mds/system/mdsDirectory.db	0644     0     0 1242423369   51288 -
f ./private/var/tmp/mds/system/mdsObject.db	0644     0     0 1242423369    4856 -
f ./private/var/vm/sleepimage          	1600     0     0 1242423368 1073741824 -
f ./private/var/vm/swapfile0           	1600     0     0 1242423370 67108864 -
f ./System/Library/Caches/com.apple.bootefisignature	0644     0     0 1242423309      41 -
f ./System/Library/Caches/com.apple.bootstamps/414E3E83-1E0C-314F-A888-DA0DF4617E91/:usr:standalone:i386:Firmware.scap	0644     0    99 1232979022       0 -
f ./System/Library/Caches/com.apple.Components2.SystemCache.Components	0644     0     0 1242418494   20906 -
f ./System/Library/Caches/com.apple.Components2.SystemCache.QuickTimeComponents	0644     0     0 1242418494   61466 -
f ./System/Library/Caches/com.apple.IntlDataCache.le	0644     0     0 1242423383   11756 -
f ./System/Library/Caches/com.apple.IntlDataCache.le.sbdl	0644     0     0 1242423383   19336 -
f ./System/Library/Caches/com.apple.IntlDataCache.le.tecx	0644     0     0 1242423373   18532 -
d ./System/Library/Caches/com.apple.kernelcaches	0755     0     0
f ./System/Library/Caches/com.apple.kernelcaches/kernelcache.99141E56	0644     0     0 1242418495 6129574 -
a ./System/Library/CoreServices/.disk_label	0644     0     0 1242423324     447 -
f ./System/Library/CoreServices/.disk_label.contentDetails	0644     0     0 1242423324       6 -
f ./System/Library/CoreServices/boot.efi	0644     0     0 1242423309  297256 -
f ./System/Library/Extensions/Caches/com.apple.kext.info	0644     0     0 1242418495  320582 -
f ./System/Library/LaunchDaemons/com.apple.configureLocalKDC.plist	0644     0     0 1242423387     447 -
f ./System/Library/LaunchDaemons/com.apple.kdcmond.plist	0644     0     0 1242423378     702 -
- f ./System/Library/LaunchDaemons/com.apple.su.startup.plist	0644     0     0 1242418484     390 -
- f ./System/Library/LaunchDaemons/com.apple.UpdateSettings.plist	0644     0     0 1235452271     406 -
f ./System/Library/LaunchDaemons/org.samba.winbindd.plist	0644     0     0 1242423362     902 -
- d ./System/Library/StartupItems/AutoBind	0755     0     0
- f ./System/Library/StartupItems/AutoBind/AutoBind	0755     0     0 1190605965     405 -
- f ./System/Library/StartupItems/AutoBind/StartupParameters.plist	0644     0     0 1190605965     485 -
d ./Volumes/boot                       	0111     0    80
f ./Volumes/boot/.autodiskmounted      	0644     0    80 1242423373       0 -
d ./Volumes/current                    	0111     0    80
f ./Volumes/current/.autodiskmounted   	0644     0    80 1242423370       0 -
l ./Volumes/target                     	0755     0    80 /

Changes filtered by standard Negative

d ./.Trashes                           	1333     0    80 AAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
- d ./cores                              	1775     0    80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
d ./home                               	0555     0    80
a ./Library/ColorSync/Profiles/Displays/Color\bLCD-42717C0.icc	0644     0    80 1242423388    4010 -
f ./Library/Keychains/.fl947E1BDB      	0444     0    80 1242423371       0 -
f ./Library/Keychains/System.keychain  	0644     0    80 1242423376   29476 -
- d ./Library/Managed\bPreferences       	0755     0    80
f ./Library/Preferences/com.apple.alf.plist	0644     0    80 1242423360    1822 -
f ./Library/Preferences/com.apple.BezelServices.plist	0644     0    80 1242423711     515 -
f ./Library/Preferences/com.apple.Bluetooth.plist	0644     0    80 1242423390     906 -
f ./Library/Preferences/com.apple.CoreRAIDServer.cfdb	0664     0    80 1242423370      60 -
f ./Library/Preferences/com.apple.HIToolbox.plist	0644     0    80 1242423397     216 -
f ./Library/Preferences/com.apple.loginwindow.plist	0644     0    80 1242423711      63 -
- f ./Library/Preferences/com.apple.SoftwareUpdate.plist	0644   501    80 1201112008       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./Library/Preferences/com.apple.TimeMachine.plist	0644   501    80 1201111256       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./Library/Preferences/DirectoryService/ContactsNodeConfig.plist	0600     0    80 1242423377     430 -
f ./Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist	0600     0    80 1242423377     324 -
f ./Library/Preferences/DirectoryService/DirectoryService.plist	0600     0    80 1242423357     374 -
f ./Library/Preferences/DirectoryService/DirectoryServiceDebug.plist	0600     0    80 1242423357     507 -
f ./Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist	0600     0    80 1242423358     455 -
f ./Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist	0644     0    80 1242423357     249 -
f ./Library/Preferences/DirectoryService/SearchNodeConfig.plist	0600     0    80 1242423376     430 -
f ./Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist	0600     0    80 1242423376     324 -
f ./Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist	0644     0     0 1242423386     230 -
d ./net                                	0555     0    80
f ./private/etc/authorization          	0644     0     0 1242423371   20842 -
- d ./private/etc/com.apple.su.startup   	0755     0     0
- f ./private/etc/com.apple.su.startup/auth_sys_print_admin	0755     0     0 1242418484   23344 -
- f ./private/etc/com.apple.su.startup/su.startup	0755     0     0 1242418484     415 -
- f ./private/etc/cups/printers.conf     	0600     0    26 1194381759       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/etc/krb5.keytab            	0600     0     0 1242423387    1319 -
f ./private/etc/memberd.conf           	0755     0     0 1242423357     124 -
- f ./private/etc/ssh_host_dsa_key       	0600     0     0 1180528981       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/etc/ssh_host_dsa_key.pub   	0644     0     0 1180528981       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/etc/ssh_host_key           	0600     0     0 1180529068       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/etc/ssh_host_key.pub       	0644     0     0 1180529068       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/etc/ssh_host_rsa_key       	0600     0     0 1180528979       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/etc/ssh_host_rsa_key.pub   	0644     0     0 1180528979       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/db/.AutoBindDone       	0644     0     0 1242423386       0 -
f ./private/var/db/.com.apple.iokit.graphics	0644     0     0 1242423387     333 -
d ./private/var/db/DirectoryService    	0750     0     0
d ./private/var/db/dslocal/indices     	0755     0     0
d ./private/var/db/dslocal/indices/Default	0700     0     0
f ./private/var/db/dyld/dyld_shared_cache_i386	0644     0     0 1242423424 132526080 -
f ./private/var/db/dyld/dyld_shared_cache_i386.map	0644     0     0 1242423428   39510 -
- f ./private/var/db/InstallResults.plist	0644     0     0 1242418196     240 -
- f ./private/var/db/ntp.drift           	0644     0     0 1179423459       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/db/PanicReporter       	0775     0    80
- d ./private/var/db/shadow/hash         	0700     0     0
f ./private/var/db/smb.conf            	0644     0     0 1242423399    1123 -
- d ./private/var/db/Spotlight-V100      	0700     0     0
- d ./private/var/db/sudo                	0700     0     0
- f ./private/var/db/volinfo.database    	0644     0     0 1179348698       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/asl.db             	0600     0     0 1179344558       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/daily.out          	0644     0     0 1179818102       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/install.log        	0640     0    80 1179349203       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/mail.log           	0644     0     0 1180463047       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/mb.log             	0644     0     0 1179344541       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/monthly.out        	0644     0     0 1178011800       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/seatbelt.log       	0644     0     0 1179344541       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/system.log         	0644     0     0 1242423712   25449 -
- f ./private/var/log/weekly.out         	0644     0     0 1179559083       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/root/Library/Autosave\bInformation	0700     0     0
d ./private/var/root/Library/Preferences/ByHost	0700     0     0
f ./private/var/root/Library/Preferences/ByHost/.GlobalPreferences.0019e3446c6a.plist	0600     0     0 1242423388      96 -
f ./private/var/root/Library/Preferences/ByHost/com.apple.Bluetooth.0019e3446c6a.plist	0600     0     0 1242423391     467 -
a ./System/Library/CoreServices/.disk_label	0644     0     0 1242423324     447 -
f ./System/Library/CoreServices/.disk_label.contentDetails	0644     0     0 1242423324       6 -
f ./System/Library/CoreServices/boot.efi	0644     0     0 1242423309  297256 -
f ./System/Library/LaunchDaemons/com.apple.configureLocalKDC.plist	0644     0     0 1242423387     447 -
f ./System/Library/LaunchDaemons/com.apple.kdcmond.plist	0644     0     0 1242423378     702 -
- f ./System/Library/LaunchDaemons/com.apple.su.startup.plist	0644     0     0 1242418484     390 -
- f ./System/Library/LaunchDaemons/com.apple.UpdateSettings.plist	0644     0     0 1235452271     406 -
f ./System/Library/LaunchDaemons/org.samba.winbindd.plist	0644     0     0 1242423362     902 -
- d ./System/Library/StartupItems/AutoBind	0755     0     0
- f ./System/Library/StartupItems/AutoBind/AutoBind	0755     0     0 1190605965     405 -
- f ./System/Library/StartupItems/AutoBind/StartupParameters.plist	0644     0     0 1190605965     485 -

Changes filtered by Negative and standard exclude

d ./.Trashes                           	1333     0    80 AAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
- d ./cores                              	1775     0    80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
d ./home                               	0555     0    80
f ./Library/Keychains/.fl947E1BDB      	0444     0    80 1242423371       0 -
f ./Library/Keychains/System.keychain  	0644     0    80 1242423376   29476 -
- d ./Library/Managed\bPreferences       	0755     0    80
f ./Library/Preferences/com.apple.loginwindow.plist	0644     0    80 1242423711      63 -
- f ./Library/Preferences/com.apple.SoftwareUpdate.plist	0644   501    80 1201112008       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./Library/Preferences/com.apple.TimeMachine.plist	0644   501    80 1201111256       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./Library/Preferences/DirectoryService/ContactsNodeConfig.plist	0600     0    80 1242423377     430 -
f ./Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist	0600     0    80 1242423377     324 -
f ./Library/Preferences/DirectoryService/DirectoryService.plist	0600     0    80 1242423357     374 -
f ./Library/Preferences/DirectoryService/DirectoryServiceDebug.plist	0600     0    80 1242423357     507 -
f ./Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist	0600     0    80 1242423358     455 -
f ./Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist	0644     0    80 1242423357     249 -
f ./Library/Preferences/DirectoryService/SearchNodeConfig.plist	0600     0    80 1242423376     430 -
f ./Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist	0600     0    80 1242423376     324 -
f ./Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist	0644     0     0 1242423386     230 -
d ./net                                	0555     0    80
f ./private/etc/authorization          	0644     0     0 1242423371   20842 -
- d ./private/etc/com.apple.su.startup   	0755     0     0
- f ./private/etc/com.apple.su.startup/auth_sys_print_admin	0755     0     0 1242418484   23344 -
- f ./private/etc/com.apple.su.startup/su.startup	0755     0     0 1242418484     415 -
- f ./private/etc/cups/printers.conf     	0600     0    26 1194381759       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/etc/krb5.keytab            	0600     0     0 1242423387    1319 -
f ./private/etc/memberd.conf           	0755     0     0 1242423357     124 -
f ./private/var/db/.AutoBindDone       	0644     0     0 1242423386       0 -
f ./private/var/db/.com.apple.iokit.graphics	0644     0     0 1242423387     333 -
d ./private/var/db/DirectoryService    	0750     0     0
d ./private/var/db/dslocal/indices     	0755     0     0
d ./private/var/db/dslocal/indices/Default	0700     0     0
- f ./private/var/db/ntp.drift           	0644     0     0 1179423459       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/db/PanicReporter       	0775     0    80
- d ./private/var/db/shadow/hash         	0700     0     0
f ./private/var/db/smb.conf            	0644     0     0 1242423399    1123 -
- d ./private/var/db/Spotlight-V100      	0700     0     0
- d ./private/var/db/sudo                	0700     0     0
- f ./private/var/db/volinfo.database    	0644     0     0 1179348698       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/asl.db             	0600     0     0 1179344558       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/daily.out          	0644     0     0 1179818102       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/install.log        	0640     0    80 1179349203       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/mail.log           	0644     0     0 1180463047       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/mb.log             	0644     0     0 1179344541       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/monthly.out        	0644     0     0 1178011800       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
- f ./private/var/log/seatbelt.log       	0644     0     0 1179344541       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/system.log         	0644     0     0 1242423712   25449 -
- f ./private/var/log/weekly.out         	0644     0     0 1179559083       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/root/Library/Autosave\bInformation	0700     0     0
d ./private/var/root/Library/Preferences/ByHost	0700     0     0
f ./private/var/root/Library/Preferences/ByHost/.GlobalPreferences.0019e3446c6a.plist	0600     0     0 1242423388      96 -
f ./private/var/root/Library/Preferences/ByHost/com.apple.Bluetooth.0019e3446c6a.plist	0600     0     0 1242423391     467 -
a ./System/Library/CoreServices/.disk_label	0644     0     0 1242423324     447 -
f ./System/Library/CoreServices/.disk_label.contentDetails	0644     0     0 1242423324       6 -
f ./System/Library/CoreServices/boot.efi	0644     0     0 1242423309  297256 -
f ./System/Library/LaunchDaemons/com.apple.configureLocalKDC.plist	0644     0     0 1242423387     447 -
f ./System/Library/LaunchDaemons/com.apple.kdcmond.plist	0644     0     0 1242423378     702 -
- f ./System/Library/LaunchDaemons/com.apple.su.startup.plist	0644     0     0 1242418484     390 -
- f ./System/Library/LaunchDaemons/com.apple.UpdateSettings.plist	0644     0     0 1235452271     406 -
f ./System/Library/LaunchDaemons/org.samba.winbindd.plist	0644     0     0 1242423362     902 -
- d ./System/Library/StartupItems/AutoBind	0755     0     0
- f ./System/Library/StartupItems/AutoBind/AutoBind	0755     0     0 1190605965     405 -
- f ./System/Library/StartupItems/AutoBind/StartupParameters.plist	0644     0     0 1190605965     485 -

Items created on first boot that are neither in negative nor exclude

./home
./Library/Keychains/.fl947E1BDB
./Library/Preferences/com.apple.loginwindow.plist
./Library/Preferences/DirectoryService/ContactsNodeConfig.plist
./Library/Preferences/DirectoryService/ContactsNodeConfigBackup.plist
./Library/Preferences/DirectoryService/DirectoryService.plist
./Library/Preferences/DirectoryService/DirectoryServiceDebug.plist
./Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist
./Library/Preferences/DirectoryService/DSRecordTypeRestrictions.plist
./Library/Preferences/DirectoryService/SearchNodeConfig.plist
./Library/Preferences/DirectoryService/SearchNodeConfigBackup.plist
./Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
./net
./private/etc/krb5.keytab
./private/etc/memberd.conf
./private/var/db/.AutoBindDone
./private/var/db/.com.apple.iokit.graphics
./private/var/db/DirectoryService
./private/var/db/shadow #interim dir
./private/var/db/dslocal/indices #interim dir
./private/var/db/dslocal/indices/Default #interim dir
./private/var/db/PanicReporter
./private/var/db/smb.conf
./private/var/root/Library/Autosave\bInformation
./private/var/root/Library/Preferences/ByHost/*
./System/Library/CoreServices/.disk_label
./System/Library/CoreServices/.disk_label.contentDetails
./System/Library/LaunchDaemons/com.apple.kdcmond.plist
./Library/Preferences/com.apple.alf.plist
./Library/Preferences/com.apple.Bluetooth.plist
./Library/Preferences/com.apple.CoreRAIDServer.cfdb
./Library/Preferences/com.apple.HIToolbox.plist

present in unbooted - removed on first boot:

    # 10.5.7:
    -./private/etc/com.apple.su.startup
    -./private/etc/com.apple.su.startup/auth_sys_print_admin
    -./private/etc/com.apple.su.startup/su.startup
    -./System/Library/LaunchDaemons/com.apple.su.startup.plist
-./private/var/db/InstallResults.plist
-./System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
-./System/Library/StartupItems/AutoBind
-./System/Library/StartupItems/AutoBind/AutoBind
-./System/Library/StartupItems/AutoBind/StartupParameters.plist
-./private/var/run/.scratch #in negative - not critical

Files that are Updated - not created on first boot:

./Library/Keychains/System.keychain
./private/etc/authorization
./System/Library/CoreServices/boot.efi
# These launchd items are disabled on first boot:
# calls /usr/libexec/configureLocalKDC
./System/Library/LaunchDaemons/com.apple.configureLocalKDC.plist
# calls /usr/sbin/winbindd
./System/Library/LaunchDaemons/org.samba.winbindd.plist
Personal tools