https://www.macforensics.app/en/blog Latest from Blog en Wed, 30 Sep 2026 00:53:54 GMT https://www.macforensics.app/en/blog/apfs-snapshots-and-timestamps https://www.macforensics.app/en/blog/apfs-snapshots-and-timestamps How APFS volumes, firmlinks, local snapshots and nanosecond timestamps work on macOS, and how to use them to build timelines and spot timestomping. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/apple-silicon-forensics https://www.macforensics.app/en/blog/apple-silicon-forensics How Apple Silicon changes Mac forensics: Secure Enclave, always-on storage encryption, Share Disk, boot security policy, SSV and acquisition strategy. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/fsevents-forensics https://www.macforensics.app/en/blog/fsevents-forensics How the macOS .fseventsd logs record file creation, deletion and rename events, how to parse them, and how to estimate dates without per-record timestamps. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/keychain-forensics-concepts https://www.macforensics.app/en/blog/keychain-forensics-concepts Understand macOS keychains for DFIR: login and System keychains, the data protection keychain, iCloud Keychain, metadata value and legal limits. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/knowledgec-and-biome https://www.macforensics.app/en/blog/knowledgec-and-biome Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/launchd-persistence-investigation https://www.macforensics.app/en/blog/launchd-persistence-investigation Find and analyze macOS persistence: LaunchAgents, LaunchDaemons, launchctl, Background Task Management (sfltool dumpbtm), cron, periodic and profiles. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/macos-forensic-acquisition https://www.macforensics.app/en/blog/macos-forensic-acquisition How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/macos-unified-logs-forensics https://www.macforensics.app/en/blog/macos-unified-logs-forensics Investigate macOS Unified Logs: tracev3 and uuidtext storage, log show predicates, logarchive collection, private redaction, retention and offline parsing. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/quarantine-events-and-gatekeeper https://www.macforensics.app/en/blog/quarantine-events-and-gatekeeper Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/safari-browser-forensics https://www.macforensics.app/en/blog/safari-browser-forensics Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/spotlight-forensics https://www.macforensics.app/en/blog/spotlight-forensics How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.macforensics.app/en/blog/tcc-database-forensics https://www.macforensics.app/en/blog/tcc-database-forensics Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT