03 · APFS, Snapshots & FSEvents
FSEvents Forensics: The macOS File System Change Log
How the macOS .fseventsd logs record file creation, deletion and rename events, how to parse them, and how to estimate dates without per-record timestamps.
Read guide