06 · TCC & Keychain
TCC Database Forensics: macOS Privacy Permissions
Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence.
Read guide
06 · Evidence area
TCC & Keychain
Transparency, Consent and Control (TCC) records every privacy permission a Mac has granted, which makes it a map of what an attacker needed. The keychain, handled lawfully, adds metadata about accounts, networks and services. Both are protected, so acquisition context matters.
- TCC.db
- login.keychain-db
- MDMOverrides.plist
2 guides in this area
06 · TCC & Keychain
macOS Keychain Forensics: Concepts and Metadata
Understand macOS keychains for DFIR: login and System keychains, the data protection keychain, iCloud Keychain, metadata value and legal limits.
Read guide
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- TCC.db: macOS Privacy Permission GrantsThe macOS TCC databases record which apps were allowed or denied camera, microphone, screen, disk and automation access, and when that last changed.
- macOS Keychain Files: Metadata for ForensicsmacOS keychains store credentials, keys and certificates; their metadata shows which accounts, services and certificates existed and when items changed.
- dslocal User Accounts: macOS Local Users and Groupsdslocal plists define every local macOS account and group, with creation, password-change and failed-login times that expose rogue or hidden accounts.
- Configuration Profiles and MDM: macOS Managed SettingsmacOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.
- SSH and Remote Login on macOS: Keys, Hosts and LogsmacOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.
- iPhone Backups and Pairing Records on a MacFinder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.