Artefactos forenses de macOS

Crash Reports: macOS DiagnosticReports (.ips)Inglés

macOS crash and diagnostic reports record which binary crashed, its path, parent, signing identity, launch and crash time, even for malware.

/Library/Logs/DiagnosticReports/

Evidencias de Gatekeeper y XProtect en macOS

Gatekeeper, XProtect y XProtect Remediator dejan entradas de log y bases de datos que muestran qué código se evaluó, aprobó, marcó o eliminó.

/var/db/SystemPolicyConfiguration/ExecPolicy

Historial de shell en macOS: zsh, bash y sesiones Terminal

Historial de shell de macOS en .zsh_history, .bash_history y las sesiones de Terminal por ventana: qué comandos tecleó un usuario y cuándo, aproximadamente.

~/.zsh_history

InstallHistory.plist: macOS Software Install LogInglés

InstallHistory.plist and the package receipt database show which apps, packages and system updates were installed on a Mac, by which process and when.

/Library/Receipts/InstallHistory.plist

Mounted Disk Images on macOS: DMG, ISO and App TranslocationInglés

How to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.

/Volumes/<name>/ (mount point), plus logs and per-user caches

sudo Logs: macOS Privilege Escalation EvidenceInglés

sudo events in macOS Unified Logs, the sudoers configuration and the /var/db/sudo timestamp files show who ran which commands as root, and when.

/private/var/db/diagnostics/

TCC.db: permisos de privacidad concedidos en macOS

Las bases TCC de macOS registran qué apps obtuvieron o no acceso a cámara, micrófono, pantalla, disco y automatización, y cuándo cambió por última vez.

/Library/Application Support/com.apple.TCC/TCC.db

Configuration Profiles and MDM: macOS Managed SettingsInglés

macOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.

/private/var/db/ConfigurationProfiles/

cron, at and periodic: macOS Scheduled Job PersistenceInglés

Legacy macOS schedulers (cron tabs, at jobs, periodic scripts, emond rules): where they live, which versions still run them and how to spot abuse.

/usr/lib/cron/tabs/

Ítems de inicio y base de datos BTM en macOS

Los ítems de inicio y el almacén Background Task Management (Ventura+) listan ítems, agentes y daemons con desarrollador, team ID y estado de aprobación.

/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btm

Kernel and System Extensions: macOS kext EvidenceInglés

Kernel extensions and system extensions on macOS: KextPolicy load history, the SystemExtensions database and what they show about drivers, EDR and rootkits.

/Library/SystemExtensions/db.plist and /private/var/db/SystemPolicyConfiguration/KextPolicy

LaunchAgents y LaunchDaemons: persistencia en macOS

Los plists de launchd en LaunchAgents y LaunchDaemons definen qué inicia macOS al arrancar, al iniciar sesión o con horario: el principal punto de persistencia.

~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons

Cloud Storage Clients on Mac: Dropbox, Drive, OneDriveInglés

Dropbox, Google Drive and OneDrive on macOS keep sync databases, logs and File Provider folders that show which files were synced, shared or uploaded.

~/Library/CloudStorage/ plus each client's Application Support, Group Container and log folders

CUPS Print Jobs and Logs: macOS Printing ForensicsInglés

macOS prints through CUPS: spool control files, page_log and access_log show which documents were printed, by whom, on which printer and when.

/private/var/spool/cups/ and /private/var/log/cups/

FSEvents (.fseventsd): cambios del sistema de archivos

Logs gzip por volumen escritos por fseventsd: rutas creadas, modificadas, renombradas y borradas, a menudo la única huella de un archivo eliminado.

/System/Volumes/Data/.fseventsd/

iCloud Drive (CloudDocs): macOS Sync Folders and DatabasesInglés

iCloud Drive local folders and the CloudDocs client.db and server.db databases that list synced files, versions and the devices that wrote them.

~/Library/Application Support/CloudDocs/session/db/client.db

Marcas de tiempo APFS y snapshots locales en macOS

Marcas de tiempo APFS en nanosegundos, Date Added de directorio y snapshots locales de Time Machine: la base de las líneas de tiempo y la recuperación en macOS.

/System/Volumes/Data

Microsoft Office and Outlook for Mac: MRU and Mailbox DataInglés

Office for Mac keeps recent-file lists in securebookmarks plists and MicrosoftRegistrationDB.reg; Outlook for Mac stores mail in a local profile database.

~/Library/Containers/com.microsoft.<App>/ and ~/Library/Group Containers/UBF8T346G9.Office/

Photos.sqlite: macOS Photos Library MetadataInglés

Photos.sqlite in the macOS Photos library records each photo and video with capture time, location, import source, trash state and original filename.

~/Pictures/Photos Library.photoslibrary/database/Photos.sqlite

QuarantineEventsV2 y xattr de cuarentena en macOS

QuarantineEventsV2 y el atributo com.apple.quarantine registran qué se descargó, desde qué URL, con qué app y cuándo, a menudo aunque el archivo ya no exista.

~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

QuickLook Thumbnail Cache: macOS File Preview EvidenceInglés

The QuickLook thumbnail cache (index.sqlite and thumbnails.data) records files previewed in Finder, with paths, hit counts and cached images.

$(getconf DARWIN_USER_CACHE_DIR)/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/

Recent Items (.sfl2/.sfl3): macOS Shared File ListsInglés

sharedfilelistd lists of recent documents, apps, servers and per-app Open Recent entries, stored as NSKeyedArchiver plists with bookmarks.

~/Library/Application Support/com.apple.sharedfilelist/

Spotlight Store (.Spotlight-V100): macOS Metadata IndexInglés

Per-volume Spotlight index and per-user CoreSpotlight stores holding file metadata such as download origin, last used date and use count.

/System/Volumes/Data/.Spotlight-V100/Store-V2/<UUID>/store.db

Time Machine Backups: macOS Configuration and HistoryInglés

Time Machine settings, destinations and backup sets on HFS+ and APFS disks: a source of older file versions and proof of when backups ran.

/Library/Preferences/com.apple.TimeMachine.plist

Apple Mail: Envelope Index and EMLX on macOSInglés

Apple Mail keeps message metadata in the Envelope Index SQLite database and each message as an .emlx file, showing email sent, received and opened.

~/Library/Mail/V10/MailData/Envelope Index

Apple Notes NoteStore.sqlite: macOS Notes ForensicsInglés

NoteStore.sqlite holds Apple Notes on macOS: note text as compressed protobuf, folders, accounts, attachments, locked notes and Recently Deleted items.

~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite

Calendar, Contacts and Reminders Databases on macOSInglés

Where macOS stores Calendar events, Contacts (AddressBook .abcddb) and Reminders, and what they show about meetings, relationships and tasks.

~/Library/Application Support/AddressBook/, ~/Library/Group Containers/group.com.apple.reminders/, ~/Library/Calendars/ or group.com.apple.calendar

Chrome and Firefox History on macOSInglés

Chrome History and Firefox places.sqlite on macOS: paths, profiles, key tables and epochs to rebuild visits and downloads outside Safari.

~/Library/Application Support/Google/Chrome/Default/History

Dock and Finder Plists: macOS User Preference EvidenceInglés

com.apple.dock.plist and com.apple.finder.plist record pinned and recent apps, recent folders, Go to Folder history, servers and searches.

~/Library/Preferences/com.apple.finder.plist

dslocal User Accounts: macOS Local Users and GroupsInglés

dslocal plists define every local macOS account and group, with creation, password-change and failed-login times that expose rogue or hidden accounts.

/private/var/db/dslocal/nodes/Default/users/<name>.plist

Flujos Biome SEGB: foco y actividad de apps en macOS

Biome guarda flujos de actividad de macOS como App.InFocus en archivos SEGB con registros protobuf, el relevo de muchos flujos de knowledgeC.db.

~/Library/Biome/streams/restricted/<Stream>/local/

knowledgeC.db: uso de apps y actividad del Mac

Base de datos SQLite de CoreDuet que registra uso de apps, foco, pantalla y alimentación en macOS: muestra cuándo y cuánto tiempo se usó cada app.

/private/var/db/CoreDuet/Knowledge/knowledgeC.db

macOS Keychain Files: Metadata for ForensicsInglés

macOS keychains store credentials, keys and certificates; their metadata shows which accounts, services and certificates existed and when items changed.

~/Library/Keychains/

Messages chat.db: macOS iMessage and SMS HistoryInglés

chat.db is the macOS Messages SQLite database of iMessage, SMS and RCS conversations, participants, attachments and recently deleted messages.

~/Library/Messages/chat.db

Notification Center Database: macOS Notification HistoryInglés

The usernoted SQLite database keeps delivered macOS notifications with app, title, body and time, often preserving message text from other apps.

~/Library/Group Containers/group.com.apple.usernoted/db2/db

Safari History.db: historial de navegación en macOS

History.db de Safari, bases de datos de perfiles, Downloads.plist y almacenes de pestañas en macOS: qué páginas visitó un usuario, cuándo y qué se borró.

~/Library/Safari/History.db

Saved Application State: macOS Window and Terminal HistoryInglés

macOS Saved Application State (.savedState) restores windows at relaunch and keeps window titles, open documents and even Terminal scrollback text.

~/Library/Saved Application State/<bundle-id>.savedState/

Screen Time Databases: macOS App Usage TotalsInglés

ScreenTimeAgent RMAdminStore databases on macOS hold per-app and per-domain usage totals, pickups and notification counts per device and user.

/private/var/folders/<xx>/<id>/0/com.apple.ScreenTimeAgent/Store/

netusage.sqlite: macOS Per-Process Network UsageInglés

netusage.sqlite records which processes used the network on a Mac, with first and last seen times and bytes over Wi-Fi, wired and cellular links.

/private/var/networkd/db/netusage.sqlite

Screen Sharing and Apple Remote Desktop ArtifactsInglés

macOS Screen Sharing and Apple Remote Desktop leave connection history, screensharingd log events and ARD caches that show remote control of a Mac.

/private/var/db/RemoteManagement/ and ~/Library/Containers/com.apple.ScreenSharing/

SSH and Remote Login on macOS: Keys, Hosts and LogsInglés

macOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.

~/.ssh/ and /private/etc/ssh/

Wi-Fi Known Networks on macOS: Plists and LogsInglés

macOS known Wi-Fi networks in com.apple.wifi.known-networks.plist, airport preferences, wifi.log and Unified Logs: where a Mac has connected, and when.

/Library/Preferences/com.apple.wifi.known-networks.plist

Bluetooth Devices on macOS: Paired and SeenInglés

macOS Bluetooth artifacts: com.apple.Bluetooth.plist, MobileBluetooth device plist and LE databases, and bluetoothd logs to show which devices paired and when.

/Library/Bluetooth/Library/Preferences/com.apple.MobileBluetooth.devices.plist

iPhone Backups and Pairing Records on a MacInglés

Finder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.

~/Library/Application Support/MobileSync/Backup/<UDID>/

USB Devices: macOS Removable Media HistoryInglés

macOS keeps no USB registry: rebuild removable media history from Unified Logs, DiskArbitration mounts, FSEvents, Spotlight and the device itself.

/private/var/db/diagnostics/

macOS Trash and .DS_Store: Deleted File EvidenceInglés

The macOS Trash keeps deleted files with their original location in .DS_Store put-back records, showing what a user deleted, from where and when.

~/.Trash/ and /Volumes/<volume>/.Trashes/<uid>/

System Logs: macOS /var/log Text and ASL FilesInglés

The flat log files that survive on macOS (install.log, system.log, wifi.log, ASL stores) and how syslogd, aslmanager and newsyslog rotate them.

/private/var/log/

Unified Logs: registro del sistema tracev3 en macOS

Los Unified Logs de macOS (tracev3 y uuidtext) registran inicios de sesión, sudo, TCC, Gatekeeper, instalaciones y dispositivos con precisión de subsegundo.

/private/var/db/diagnostics/