03 · APFS, Snapshots & FSEvents
APFS Snapshots and Timestamps: A Forensic Guide for macOS
How APFS volumes, firmlinks, local snapshots and nanosecond timestamps work on macOS, and how to use them to build timelines and spot timestomping.
Read guide
Guides tagged: #timeline
03 · APFS, Snapshots & FSEvents
FSEvents Forensics: The macOS File System Change Log
How the macOS .fseventsd logs record file creation, deletion and rename events, how to parse them, and how to estimate dates without per-record timestamps.
Read guide