06 · TCC & Keychain
macOS Keychain Forensics: Concepts and Metadata
Understand macOS keychains for DFIR: login and System keychains, the data protection keychain, iCloud Keychain, metadata value and legal limits.
Read guide
Guides tagged: #privacy
06 · TCC & Keychain
TCC Database Forensics: macOS Privacy Permissions
Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence.
Read guide