Forensische macOS-Artefakte

Crash Reports: macOS DiagnosticReports (.ips)Englisch

macOS crash and diagnostic reports record which binary crashed, its path, parent, signing identity, launch and crash time, even for malware.

/Library/Logs/DiagnosticReports/

Gatekeeper- und XProtect-Spuren unter macOS

Gatekeeper, XProtect und XProtect Remediator hinterlassen Logs und Datenbanken, die zeigen, welcher Code geprüft, zugelassen, gemeldet oder entfernt wurde.

/var/db/SystemPolicyConfiguration/ExecPolicy

InstallHistory.plist: macOS Software Install LogEnglisch

InstallHistory.plist and the package receipt database show which apps, packages and system updates were installed on a Mac, by which process and when.

/Library/Receipts/InstallHistory.plist

Mounted Disk Images on macOS: DMG, ISO and App TranslocationEnglisch

How to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.

/Volumes/<name>/ (mount point), plus logs and per-user caches

Shell-Historie unter macOS: zsh, bash und Terminal-Sitzungen

Shell-Historie in .zsh_history, .bash_history und den Sitzungsdateien des Terminals pro Fenster: welche Befehle ein Benutzer eingab und ungefähr wann.

~/.zsh_history

sudo Logs: macOS Privilege Escalation EvidenceEnglisch

sudo events in macOS Unified Logs, the sudoers configuration and the /var/db/sudo timestamp files show who ran which commands as root, and when.

/private/var/db/diagnostics/

TCC.db: Datenschutzberechtigungen unter macOS

Die TCC-Datenbanken von macOS zeigen, welche Apps Zugriff auf Kamera, Mikrofon, Bildschirm, Festplatte und Automation erhielten und wann sich das änderte.

/Library/Application Support/com.apple.TCC/TCC.db

Anmeldeobjekte und BTM-Datenbank unter macOS

Anmeldeobjekte und der BTM-Speicher ab Ventura listen Login Items, Agents und Daemons mit Entwickler, Team-ID und Freigabestatus auf.

/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btm

Configuration Profiles and MDM: macOS Managed SettingsEnglisch

macOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.

/private/var/db/ConfigurationProfiles/

cron, at and periodic: macOS Scheduled Job PersistenceEnglisch

Legacy macOS schedulers (cron tabs, at jobs, periodic scripts, emond rules): where they live, which versions still run them and how to spot abuse.

/usr/lib/cron/tabs/

Kernel and System Extensions: macOS kext EvidenceEnglisch

Kernel extensions and system extensions on macOS: KextPolicy load history, the SystemExtensions database and what they show about drivers, EDR and rootkits.

/Library/SystemExtensions/db.plist and /private/var/db/SystemPolicyConfiguration/KextPolicy

LaunchAgents und LaunchDaemons: Persistenz unter macOS

launchd-Plists in LaunchAgents und LaunchDaemons legen fest, was macOS beim Booten, bei der Anmeldung oder nach Zeitplan startet: Persistenzort Nummer eins.

~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons

APFS-Zeitstempel und lokale Snapshots unter macOS

APFS-Zeitstempel in Nanosekunden, Hinzugefügt-Datum in Ordnern und lokale Time-Machine-Snapshots: die Basis für Zeitleisten und Wiederherstellung.

/System/Volumes/Data

Cloud Storage Clients on Mac: Dropbox, Drive, OneDriveEnglisch

Dropbox, Google Drive and OneDrive on macOS keep sync databases, logs and File Provider folders that show which files were synced, shared or uploaded.

~/Library/CloudStorage/ plus each client's Application Support, Group Container and log folders

CUPS Print Jobs and Logs: macOS Printing ForensicsEnglisch

macOS prints through CUPS: spool control files, page_log and access_log show which documents were printed, by whom, on which printer and when.

/private/var/spool/cups/ and /private/var/log/cups/

FSEvents (.fseventsd): Änderungsprotokoll des Dateisystems

Gzip-Logs pro Volume von fseventsd, die erstellte, geänderte, umbenannte und gelöschte Pfade erfassen, oft die einzige Spur einer entfernten Datei.

/System/Volumes/Data/.fseventsd/

iCloud Drive (CloudDocs): macOS Sync Folders and DatabasesEnglisch

iCloud Drive local folders and the CloudDocs client.db and server.db databases that list synced files, versions and the devices that wrote them.

~/Library/Application Support/CloudDocs/session/db/client.db

Microsoft Office and Outlook for Mac: MRU and Mailbox DataEnglisch

Office for Mac keeps recent-file lists in securebookmarks plists and MicrosoftRegistrationDB.reg; Outlook for Mac stores mail in a local profile database.

~/Library/Containers/com.microsoft.<App>/ and ~/Library/Group Containers/UBF8T346G9.Office/

Photos.sqlite: macOS Photos Library MetadataEnglisch

Photos.sqlite in the macOS Photos library records each photo and video with capture time, location, import source, trash state and original filename.

~/Pictures/Photos Library.photoslibrary/database/Photos.sqlite

QuarantineEventsV2 und Quarantäne-xattr unter macOS

QuarantineEventsV2 und das Attribut com.apple.quarantine zeigen, was von welcher URL, mit welcher App und wann geladen wurde, oft noch nach dem Löschen.

~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

QuickLook Thumbnail Cache: macOS File Preview EvidenceEnglisch

The QuickLook thumbnail cache (index.sqlite and thumbnails.data) records files previewed in Finder, with paths, hit counts and cached images.

$(getconf DARWIN_USER_CACHE_DIR)/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/

Recent Items (.sfl2/.sfl3): macOS Shared File ListsEnglisch

sharedfilelistd lists of recent documents, apps, servers and per-app Open Recent entries, stored as NSKeyedArchiver plists with bookmarks.

~/Library/Application Support/com.apple.sharedfilelist/

Spotlight Store (.Spotlight-V100): macOS Metadata IndexEnglisch

Per-volume Spotlight index and per-user CoreSpotlight stores holding file metadata such as download origin, last used date and use count.

/System/Volumes/Data/.Spotlight-V100/Store-V2/<UUID>/store.db

Time Machine Backups: macOS Configuration and HistoryEnglisch

Time Machine settings, destinations and backup sets on HFS+ and APFS disks: a source of older file versions and proof of when backups ran.

/Library/Preferences/com.apple.TimeMachine.plist

Apple Mail: Envelope Index and EMLX on macOSEnglisch

Apple Mail keeps message metadata in the Envelope Index SQLite database and each message as an .emlx file, showing email sent, received and opened.

~/Library/Mail/V10/MailData/Envelope Index

Apple Notes NoteStore.sqlite: macOS Notes ForensicsEnglisch

NoteStore.sqlite holds Apple Notes on macOS: note text as compressed protobuf, folders, accounts, attachments, locked notes and Recently Deleted items.

~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite

Biome-SEGB-Streams: App-Fokus und Aktivität unter macOS

Biome speichert macOS-Aktivitätsstreams wie App.InFocus in SEGB-Dateien mit Protobuf-Einträgen, Nachfolger vieler Streams aus knowledgeC.db.

~/Library/Biome/streams/restricted/<Stream>/local/

Calendar, Contacts and Reminders Databases on macOSEnglisch

Where macOS stores Calendar events, Contacts (AddressBook .abcddb) and Reminders, and what they show about meetings, relationships and tasks.

~/Library/Application Support/AddressBook/, ~/Library/Group Containers/group.com.apple.reminders/, ~/Library/Calendars/ or group.com.apple.calendar

Chrome and Firefox History on macOSEnglisch

Chrome History and Firefox places.sqlite on macOS: paths, profiles, key tables and epochs to rebuild visits and downloads outside Safari.

~/Library/Application Support/Google/Chrome/Default/History

Dock and Finder Plists: macOS User Preference EvidenceEnglisch

com.apple.dock.plist and com.apple.finder.plist record pinned and recent apps, recent folders, Go to Folder history, servers and searches.

~/Library/Preferences/com.apple.finder.plist

dslocal User Accounts: macOS Local Users and GroupsEnglisch

dslocal plists define every local macOS account and group, with creation, password-change and failed-login times that expose rogue or hidden accounts.

/private/var/db/dslocal/nodes/Default/users/<name>.plist

knowledgeC.db: App-Nutzung und Geräteaktivität unter macOS

SQLite-Datenbank von CoreDuet mit App-Nutzung, Fokus, Display- und Stromstatus unter macOS; zeigt, wann und wie lange Apps genutzt wurden.

/private/var/db/CoreDuet/Knowledge/knowledgeC.db

macOS Keychain Files: Metadata for ForensicsEnglisch

macOS keychains store credentials, keys and certificates; their metadata shows which accounts, services and certificates existed and when items changed.

~/Library/Keychains/

Messages chat.db: macOS iMessage and SMS HistoryEnglisch

chat.db is the macOS Messages SQLite database of iMessage, SMS and RCS conversations, participants, attachments and recently deleted messages.

~/Library/Messages/chat.db

Notification Center Database: macOS Notification HistoryEnglisch

The usernoted SQLite database keeps delivered macOS notifications with app, title, body and time, often preserving message text from other apps.

~/Library/Group Containers/group.com.apple.usernoted/db2/db

Safari History.db: Browserverlauf unter macOS

Safari History.db, Profildatenbanken, Downloads.plist und Tab-Speicher unter macOS: welche Seiten ein Benutzer wann besuchte und was gelöscht wurde.

~/Library/Safari/History.db

Saved Application State: macOS Window and Terminal HistoryEnglisch

macOS Saved Application State (.savedState) restores windows at relaunch and keeps window titles, open documents and even Terminal scrollback text.

~/Library/Saved Application State/<bundle-id>.savedState/

Screen Time Databases: macOS App Usage TotalsEnglisch

ScreenTimeAgent RMAdminStore databases on macOS hold per-app and per-domain usage totals, pickups and notification counts per device and user.

/private/var/folders/<xx>/<id>/0/com.apple.ScreenTimeAgent/Store/

netusage.sqlite: macOS Per-Process Network UsageEnglisch

netusage.sqlite records which processes used the network on a Mac, with first and last seen times and bytes over Wi-Fi, wired and cellular links.

/private/var/networkd/db/netusage.sqlite

Screen Sharing and Apple Remote Desktop ArtifactsEnglisch

macOS Screen Sharing and Apple Remote Desktop leave connection history, screensharingd log events and ARD caches that show remote control of a Mac.

/private/var/db/RemoteManagement/ and ~/Library/Containers/com.apple.ScreenSharing/

SSH and Remote Login on macOS: Keys, Hosts and LogsEnglisch

macOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.

~/.ssh/ and /private/etc/ssh/

Wi-Fi Known Networks on macOS: Plists and LogsEnglisch

macOS known Wi-Fi networks in com.apple.wifi.known-networks.plist, airport preferences, wifi.log and Unified Logs: where a Mac has connected, and when.

/Library/Preferences/com.apple.wifi.known-networks.plist

Bluetooth Devices on macOS: Paired and SeenEnglisch

macOS Bluetooth artifacts: com.apple.Bluetooth.plist, MobileBluetooth device plist and LE databases, and bluetoothd logs to show which devices paired and when.

/Library/Bluetooth/Library/Preferences/com.apple.MobileBluetooth.devices.plist

iPhone Backups and Pairing Records on a MacEnglisch

Finder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.

~/Library/Application Support/MobileSync/Backup/<UDID>/

USB Devices: macOS Removable Media HistoryEnglisch

macOS keeps no USB registry: rebuild removable media history from Unified Logs, DiskArbitration mounts, FSEvents, Spotlight and the device itself.

/private/var/db/diagnostics/

macOS Trash and .DS_Store: Deleted File EvidenceEnglisch

The macOS Trash keeps deleted files with their original location in .DS_Store put-back records, showing what a user deleted, from where and when.

~/.Trash/ and /Volumes/<volume>/.Trashes/<uid>/

System Logs: macOS /var/log Text and ASL FilesEnglisch

The flat log files that survive on macOS (install.log, system.log, wifi.log, ASL stores) and how syslogd, aslmanager and newsyslog rotate them.

/private/var/log/

Unified Logs: macOS-Systemprotokoll im tracev3-Format

macOS Unified Logs (tracev3 plus uuidtext) erfassen Anmeldungen, sudo, TCC, Gatekeeper, Installationen und Geräte mit Zeitstempeln unter einer Sekunde.

/private/var/db/diagnostics/