02 · Unified Logs
macOS Unified Logs Forensics: tracev3, log show, Predicates
Investigate macOS Unified Logs: tracev3 and uuidtext storage, log show predicates, logarchive collection, private redaction, retention and offline parsing.
Read guide
02 · Evidence area
Unified Logs
The Unified Logging system is the richest and most volatile record on a Mac. Learn where tracev3 files live, how to export a logarchive, which predicates surface authentication and execution, and how to work around <private> redaction and short retention.
- /private/var/db/diagnostics
- uuidtext
- .logarchive
1 guides in this area
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- Unified Logs: macOS tracev3 System LoggingmacOS Unified Logs (tracev3 plus uuidtext) record logins, sudo, TCC, Gatekeeper, installs and device activity with sub-second timestamps.
- System Logs: macOS /var/log Text and ASL FilesThe flat log files that survive on macOS (install.log, system.log, wifi.log, ASL stores) and how syslogd, aslmanager and newsyslog rotate them.
- sudo Logs: macOS Privilege Escalation Evidencesudo events in macOS Unified Logs, the sudoers configuration and the /var/db/sudo timestamp files show who ran which commands as root, and when.
- Crash Reports: macOS DiagnosticReports (.ips)macOS crash and diagnostic reports record which binary crashed, its path, parent, signing identity, launch and crash time, even for malware.
- InstallHistory.plist: macOS Software Install LogInstallHistory.plist and the package receipt database show which apps, packages and system updates were installed on a Mac, by which process and when.
- SSH and Remote Login on macOS: Keys, Hosts and LogsmacOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.
- Screen Sharing and Apple Remote Desktop ArtifactsmacOS Screen Sharing and Apple Remote Desktop leave connection history, screensharingd log events and ARD caches that show remote control of a Mac.
- Configuration Profiles and MDM: macOS Managed SettingsmacOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.
- CUPS Print Jobs and Logs: macOS Printing ForensicsmacOS prints through CUPS: spool control files, page_log and access_log show which documents were printed, by whom, on which printer and when.