04 · User Activity
Safari Forensics on macOS: History.db, Downloads and Tabs
Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries.
Read guide
Guides
04 · User Activity
Spotlight Forensics: Metadata Stores, mdls and Parsing
How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS.
Read guide
06 · TCC & Keychain
TCC Database Forensics: macOS Privacy Permissions
Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence.
Read guide