Artefacts forensiques macOS

Crash Reports: macOS DiagnosticReports (.ips)Anglais

macOS crash and diagnostic reports record which binary crashed, its path, parent, signing identity, launch and crash time, even for malware.

/Library/Logs/DiagnosticReports/

Historique du shell sous macOS : zsh, bash et Terminal

L'historique du shell macOS dans .zsh_history, .bash_history et les fichiers de session du Terminal : quelles commandes ont été tapées et vers quand.

~/.zsh_history

InstallHistory.plist: macOS Software Install LogAnglais

InstallHistory.plist and the package receipt database show which apps, packages and system updates were installed on a Mac, by which process and when.

/Library/Receipts/InstallHistory.plist

Mounted Disk Images on macOS: DMG, ISO and App TranslocationAnglais

How to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.

/Volumes/<name>/ (mount point), plus logs and per-user caches

sudo Logs: macOS Privilege Escalation EvidenceAnglais

sudo events in macOS Unified Logs, the sudoers configuration and the /var/db/sudo timestamp files show who ran which commands as root, and when.

/private/var/db/diagnostics/

TCC.db : autorisations de confidentialité sous macOS

Les bases TCC de macOS indiquent quelles apps ont obtenu ou non l'accès à la caméra, au micro, à l'écran, au disque et à l'automatisation, et quand.

/Library/Application Support/com.apple.TCC/TCC.db

Traces de Gatekeeper et XProtect sous macOS

Gatekeeper, XProtect et XProtect Remediator laissent journaux et bases qui montrent quel code a été évalué, approuvé, signalé ou supprimé.

/var/db/SystemPolicyConfiguration/ExecPolicy

Configuration Profiles and MDM: macOS Managed SettingsAnglais

macOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.

/private/var/db/ConfigurationProfiles/

cron, at and periodic: macOS Scheduled Job PersistenceAnglais

Legacy macOS schedulers (cron tabs, at jobs, periodic scripts, emond rules): where they live, which versions still run them and how to spot abuse.

/usr/lib/cron/tabs/

Éléments de connexion et base BTM sous macOS

Les éléments de connexion et la base Background Task Management (Ventura+) listent items, agents et démons avec développeur, team ID et approbation.

/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btm

Kernel and System Extensions: macOS kext EvidenceAnglais

Kernel extensions and system extensions on macOS: KextPolicy load history, the SystemExtensions database and what they show about drivers, EDR and rootkits.

/Library/SystemExtensions/db.plist and /private/var/db/SystemPolicyConfiguration/KextPolicy

LaunchAgents et LaunchDaemons : persistance macOS

Les plists launchd des dossiers LaunchAgents et LaunchDaemons définissent ce que macOS lance au démarrage, à la connexion ou selon un planning.

~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons

Cloud Storage Clients on Mac: Dropbox, Drive, OneDriveAnglais

Dropbox, Google Drive and OneDrive on macOS keep sync databases, logs and File Provider folders that show which files were synced, shared or uploaded.

~/Library/CloudStorage/ plus each client's Application Support, Group Container and log folders

CUPS Print Jobs and Logs: macOS Printing ForensicsAnglais

macOS prints through CUPS: spool control files, page_log and access_log show which documents were printed, by whom, on which printer and when.

/private/var/spool/cups/ and /private/var/log/cups/

FSEvents (.fseventsd) : journal des changements macOS

Journaux gzip par volume écrits par fseventsd : chemins créés, modifiés, renommés et supprimés, souvent la seule trace d'un fichier effacé.

/System/Volumes/Data/.fseventsd/

Horodatages APFS et snapshots locaux sous macOS

Horodatages APFS à la nanoseconde, date d'ajout au dossier et snapshots locaux Time Machine : la base des chronologies et de la récupération sur Mac.

/System/Volumes/Data

iCloud Drive (CloudDocs): macOS Sync Folders and DatabasesAnglais

iCloud Drive local folders and the CloudDocs client.db and server.db databases that list synced files, versions and the devices that wrote them.

~/Library/Application Support/CloudDocs/session/db/client.db

Microsoft Office and Outlook for Mac: MRU and Mailbox DataAnglais

Office for Mac keeps recent-file lists in securebookmarks plists and MicrosoftRegistrationDB.reg; Outlook for Mac stores mail in a local profile database.

~/Library/Containers/com.microsoft.<App>/ and ~/Library/Group Containers/UBF8T346G9.Office/

Photos.sqlite: macOS Photos Library MetadataAnglais

Photos.sqlite in the macOS Photos library records each photo and video with capture time, location, import source, trash state and original filename.

~/Pictures/Photos Library.photoslibrary/database/Photos.sqlite

QuarantineEventsV2 et xattr de quarantaine sous macOS

QuarantineEventsV2 et l'attribut com.apple.quarantine indiquent quoi a été téléchargé, depuis quelle URL, par quelle app et quand, même après suppression.

~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

QuickLook Thumbnail Cache: macOS File Preview EvidenceAnglais

The QuickLook thumbnail cache (index.sqlite and thumbnails.data) records files previewed in Finder, with paths, hit counts and cached images.

$(getconf DARWIN_USER_CACHE_DIR)/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache/

Recent Items (.sfl2/.sfl3): macOS Shared File ListsAnglais

sharedfilelistd lists of recent documents, apps, servers and per-app Open Recent entries, stored as NSKeyedArchiver plists with bookmarks.

~/Library/Application Support/com.apple.sharedfilelist/

Spotlight Store (.Spotlight-V100): macOS Metadata IndexAnglais

Per-volume Spotlight index and per-user CoreSpotlight stores holding file metadata such as download origin, last used date and use count.

/System/Volumes/Data/.Spotlight-V100/Store-V2/<UUID>/store.db

Time Machine Backups: macOS Configuration and HistoryAnglais

Time Machine settings, destinations and backup sets on HFS+ and APFS disks: a source of older file versions and proof of when backups ran.

/Library/Preferences/com.apple.TimeMachine.plist

Apple Mail: Envelope Index and EMLX on macOSAnglais

Apple Mail keeps message metadata in the Envelope Index SQLite database and each message as an .emlx file, showing email sent, received and opened.

~/Library/Mail/V10/MailData/Envelope Index

Apple Notes NoteStore.sqlite: macOS Notes ForensicsAnglais

NoteStore.sqlite holds Apple Notes on macOS: note text as compressed protobuf, folders, accounts, attachments, locked notes and Recently Deleted items.

~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite

Calendar, Contacts and Reminders Databases on macOSAnglais

Where macOS stores Calendar events, Contacts (AddressBook .abcddb) and Reminders, and what they show about meetings, relationships and tasks.

~/Library/Application Support/AddressBook/, ~/Library/Group Containers/group.com.apple.reminders/, ~/Library/Calendars/ or group.com.apple.calendar

Chrome and Firefox History on macOSAnglais

Chrome History and Firefox places.sqlite on macOS: paths, profiles, key tables and epochs to rebuild visits and downloads outside Safari.

~/Library/Application Support/Google/Chrome/Default/History

Dock and Finder Plists: macOS User Preference EvidenceAnglais

com.apple.dock.plist and com.apple.finder.plist record pinned and recent apps, recent folders, Go to Folder history, servers and searches.

~/Library/Preferences/com.apple.finder.plist

dslocal User Accounts: macOS Local Users and GroupsAnglais

dslocal plists define every local macOS account and group, with creation, password-change and failed-login times that expose rogue or hidden accounts.

/private/var/db/dslocal/nodes/Default/users/<name>.plist

Flux Biome SEGB : focus et activité des apps sous macOS

Biome stocke des flux d'activité macOS comme App.InFocus dans des fichiers SEGB d'enregistrements protobuf, successeurs de nombreux flux knowledgeC.db.

~/Library/Biome/streams/restricted/<Stream>/local/

knowledgeC.db : usage des apps et activité sous macOS

Base SQLite CoreDuet qui enregistre usage des apps, focus, écran et alimentation sous macOS, pour savoir quand et combien de temps une app a servi.

/private/var/db/CoreDuet/Knowledge/knowledgeC.db

macOS Keychain Files: Metadata for ForensicsAnglais

macOS keychains store credentials, keys and certificates; their metadata shows which accounts, services and certificates existed and when items changed.

~/Library/Keychains/

Messages chat.db: macOS iMessage and SMS HistoryAnglais

chat.db is the macOS Messages SQLite database of iMessage, SMS and RCS conversations, participants, attachments and recently deleted messages.

~/Library/Messages/chat.db

Notification Center Database: macOS Notification HistoryAnglais

The usernoted SQLite database keeps delivered macOS notifications with app, title, body and time, often preserving message text from other apps.

~/Library/Group Containers/group.com.apple.usernoted/db2/db

Safari History.db : historique de navigation macOS

History.db de Safari, bases de profils, Downloads.plist et onglets sous macOS : quelles pages ont été visitées, quand, et ce qui a été effacé.

~/Library/Safari/History.db

Saved Application State: macOS Window and Terminal HistoryAnglais

macOS Saved Application State (.savedState) restores windows at relaunch and keeps window titles, open documents and even Terminal scrollback text.

~/Library/Saved Application State/<bundle-id>.savedState/

Screen Time Databases: macOS App Usage TotalsAnglais

ScreenTimeAgent RMAdminStore databases on macOS hold per-app and per-domain usage totals, pickups and notification counts per device and user.

/private/var/folders/<xx>/<id>/0/com.apple.ScreenTimeAgent/Store/

netusage.sqlite: macOS Per-Process Network UsageAnglais

netusage.sqlite records which processes used the network on a Mac, with first and last seen times and bytes over Wi-Fi, wired and cellular links.

/private/var/networkd/db/netusage.sqlite

Screen Sharing and Apple Remote Desktop ArtifactsAnglais

macOS Screen Sharing and Apple Remote Desktop leave connection history, screensharingd log events and ARD caches that show remote control of a Mac.

/private/var/db/RemoteManagement/ and ~/Library/Containers/com.apple.ScreenSharing/

SSH and Remote Login on macOS: Keys, Hosts and LogsAnglais

macOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.

~/.ssh/ and /private/etc/ssh/

Wi-Fi Known Networks on macOS: Plists and LogsAnglais

macOS known Wi-Fi networks in com.apple.wifi.known-networks.plist, airport preferences, wifi.log and Unified Logs: where a Mac has connected, and when.

/Library/Preferences/com.apple.wifi.known-networks.plist

Bluetooth Devices on macOS: Paired and SeenAnglais

macOS Bluetooth artifacts: com.apple.Bluetooth.plist, MobileBluetooth device plist and LE databases, and bluetoothd logs to show which devices paired and when.

/Library/Bluetooth/Library/Preferences/com.apple.MobileBluetooth.devices.plist

iPhone Backups and Pairing Records on a MacAnglais

Finder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.

~/Library/Application Support/MobileSync/Backup/<UDID>/

USB Devices: macOS Removable Media HistoryAnglais

macOS keeps no USB registry: rebuild removable media history from Unified Logs, DiskArbitration mounts, FSEvents, Spotlight and the device itself.

/private/var/db/diagnostics/

macOS Trash and .DS_Store: Deleted File EvidenceAnglais

The macOS Trash keeps deleted files with their original location in .DS_Store put-back records, showing what a user deleted, from where and when.

~/.Trash/ and /Volumes/<volume>/.Trashes/<uid>/

System Logs: macOS /var/log Text and ASL FilesAnglais

The flat log files that survive on macOS (install.log, system.log, wifi.log, ASL stores) and how syslogd, aslmanager and newsyslog rotate them.

/private/var/log/

Unified Logs : la journalisation tracev3 de macOS

Les Unified Logs de macOS (tracev3 et uuidtext) enregistrent connexions, sudo, TCC, Gatekeeper, installations et périphériques à la sous-seconde.

/private/var/db/diagnostics/