Sitemap
Every page on Mac Forensics.
Home
Guides
- APFS Snapshots and Timestamps: A Forensic Guide for macOS
- Apple Silicon Forensics: What M-Series Macs Change
- FSEvents Forensics: The macOS File System Change Log
- macOS Keychain Forensics: Concepts and Metadata
- knowledgeC.db and Biome: Reconstructing Mac User Activity
- Investigating launchd Persistence on macOS
- macOS Forensic Acquisition: Live vs Dead-Box Triage
- macOS Unified Logs Forensics: tracev3, log show, Predicates
- Quarantine Events and Gatekeeper: Tracing Mac Downloads
- Safari Forensics on macOS: History.db, Downloads and Tabs
- Spotlight Forensics: Metadata Stores, mdls and Parsing
- TCC Database Forensics: macOS Privacy Permissions
Artifacts
- APFS Timestamps and Local Snapshots on macOS
- Apple Mail: Envelope Index and EMLX on macOS
- Apple Notes NoteStore.sqlite: macOS Notes Forensics
- Biome SEGB Streams: macOS App Focus and Activity
- Bluetooth Devices on macOS: Paired and Seen
- Calendar, Contacts and Reminders Databases on macOS
- Chrome and Firefox History on macOS
- Cloud Storage Clients on Mac: Dropbox, Drive, OneDrive
- Configuration Profiles and MDM: macOS Managed Settings
- Crash Reports: macOS DiagnosticReports (.ips)
- cron, at and periodic: macOS Scheduled Job Persistence
- CUPS Print Jobs and Logs: macOS Printing Forensics
- Dock and Finder Plists: macOS User Preference Evidence
- dslocal User Accounts: macOS Local Users and Groups
- FSEvents (.fseventsd): macOS File System Change Log
- Gatekeeper and XProtect Evidence on macOS
- iCloud Drive (CloudDocs): macOS Sync Folders and Databases
- InstallHistory.plist: macOS Software Install Log
- iPhone Backups and Pairing Records on a Mac
- Kernel and System Extensions: macOS kext Evidence
- knowledgeC.db: macOS App Usage and Device Activity
- LaunchAgents and LaunchDaemons: macOS Persistence
- Login Items and BTM Database on macOS
- macOS Keychain Files: Metadata for Forensics
- macOS Trash and .DS_Store: Deleted File Evidence
- Messages chat.db: macOS iMessage and SMS History
- Microsoft Office and Outlook for Mac: MRU and Mailbox Data
- Mounted Disk Images on macOS: DMG, ISO and App Translocation
- netusage.sqlite: macOS Per-Process Network Usage
- Notification Center Database: macOS Notification History
- Photos.sqlite: macOS Photos Library Metadata
- QuarantineEventsV2 and Quarantine xattr on macOS
- QuickLook Thumbnail Cache: macOS File Preview Evidence
- Recent Items (.sfl2/.sfl3): macOS Shared File Lists
- Safari History.db: macOS Browsing History
- Saved Application State: macOS Window and Terminal History
- Screen Sharing and Apple Remote Desktop Artifacts
- Screen Time Databases: macOS App Usage Totals
- Shell History on macOS: zsh, bash and Terminal Sessions
- Spotlight Store (.Spotlight-V100): macOS Metadata Index
- SSH and Remote Login on macOS: Keys, Hosts and Logs
- sudo Logs: macOS Privilege Escalation Evidence
- System Logs: macOS /var/log Text and ASL Files
- TCC.db: macOS Privacy Permission Grants
- Time Machine Backups: macOS Configuration and History
- Unified Logs: macOS tracev3 System Logging
- USB Devices: macOS Removable Media History
- Wi-Fi Known Networks on macOS: Plists and Logs