03 · APFS, Snapshots & FSEvents
APFS Snapshots and Timestamps: A Forensic Guide for macOS
How APFS volumes, firmlinks, local snapshots and nanosecond timestamps work on macOS, and how to use them to build timelines and spot timestomping.
Read guide
03 · Evidence area
APFS, Snapshots & FSEvents
APFS gives you nanosecond timestamps, a sealed system volume and point-in-time snapshots, while fseventsd quietly records which paths were created, renamed or deleted. Together they rebuild what happened on disk, even for files that are gone.
- /.fseventsd
- tmutil
- kMDItemDateAdded
2 guides in this area
03 · APFS, Snapshots & FSEvents
FSEvents Forensics: The macOS File System Change Log
How the macOS .fseventsd logs record file creation, deletion and rename events, how to parse them, and how to estimate dates without per-record timestamps.
Read guide
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- FSEvents (.fseventsd): macOS File System Change LogPer-volume gzip logs written by fseventsd that record created, modified, renamed and deleted paths, often the only trace of a removed file.
- APFS Timestamps and Local Snapshots on macOSAPFS nanosecond file timestamps, directory Date Added and local Time Machine snapshots: the base layer for macOS file timelines and recovery.
- Time Machine Backups: macOS Configuration and HistoryTime Machine settings, destinations and backup sets on HFS+ and APFS disks: a source of older file versions and proof of when backups ran.
- Spotlight Store (.Spotlight-V100): macOS Metadata IndexPer-volume Spotlight index and per-user CoreSpotlight stores holding file metadata such as download origin, last used date and use count.
- macOS Trash and .DS_Store: Deleted File EvidenceThe macOS Trash keeps deleted files with their original location in .DS_Store put-back records, showing what a user deleted, from where and when.
- QuickLook Thumbnail Cache: macOS File Preview EvidenceThe QuickLook thumbnail cache (index.sqlite and thumbnails.data) records files previewed in Finder, with paths, hit counts and cached images.
- Mounted Disk Images on macOS: DMG, ISO and App TranslocationHow to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.
- Cloud Storage Clients on Mac: Dropbox, Drive, OneDriveDropbox, Google Drive and OneDrive on macOS keep sync databases, logs and File Provider folders that show which files were synced, shared or uploaded.