03 · APFS, Snapshots & FSEvents
APFS Snapshots and Timestamps: A Forensic Guide for macOS
How APFS volumes, firmlinks, local snapshots and nanosecond timestamps work on macOS, and how to use them to build timelines and spot timestomping.
Read guide
Guides
In-depth macOS forensics guides: artifacts, locations, parsing, SQL and investigative pitfalls.
01 · Acquisition & Triage
Apple Silicon Forensics: What M-Series Macs Change
How Apple Silicon changes Mac forensics: Secure Enclave, always-on storage encryption, Share Disk, boot security policy, SSV and acquisition strategy.
Read guide
03 · APFS, Snapshots & FSEvents
FSEvents Forensics: The macOS File System Change Log
How the macOS .fseventsd logs record file creation, deletion and rename events, how to parse them, and how to estimate dates without per-record timestamps.
Read guide
06 · TCC & Keychain
macOS Keychain Forensics: Concepts and Metadata
Understand macOS keychains for DFIR: login and System keychains, the data protection keychain, iCloud Keychain, metadata value and legal limits.
Read guide
04 · User Activity
knowledgeC.db and Biome: Reconstructing Mac User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
Read guide
05 · Execution & Persistence
Investigating launchd Persistence on macOS
Find and analyze macOS persistence: LaunchAgents, LaunchDaemons, launchctl, Background Task Management (sfltool dumpbtm), cron, periodic and profiles.
Read guide
01 · Acquisition & Triage
macOS Forensic Acquisition: Live vs Dead-Box Triage
How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC.
Read guide
02 · Unified Logs
macOS Unified Logs Forensics: tracev3, log show, Predicates
Investigate macOS Unified Logs: tracev3 and uuidtext storage, log show predicates, logarchive collection, private redaction, retention and offline parsing.
Read guide
05 · Execution & Persistence
Quarantine Events and Gatekeeper: Tracing Mac Downloads
Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions.
Read guide