Prerequisites

• macOS system with Terminal access
• Administrative privileges (sudo access)

List installed packages

Open Terminal, then enter:

pkgutil –pkgs

You’ll see a list of package identifiers, such as:

• com.apple.pkg.Xcode
• com.vendor.pkg.application

View package contents

To see which files a package installed, run:

pkgutil --files com.example.pkg.appname

To view details like the install location, run:

pkgutil --pkg-info com.example.pkg.appname

Remove the package receipt

If you want macOS to forget a package (without removing its files), run:

sudo pkgutil --forget com.example.pkg.appname

This removes the package’s receipt from the system so it no longer appears as installed.

Remove installed files

If you want to delete the files installed by the package, manually remove the paths returned from the “List installed packages” step. For example:

sudo rm -rf /Library/Application\ Support/AppName

sudo rm -rf /Applications/AppName.app

Always confirm the paths before deleting them to avoid removing required system files.

Once the evidence is removed, the next agent scan should not include the evidence in the NDI file.