Glossaire

Définitions claires des artefacts forensiques, systèmes de fichiers et mécanismes de sécurité de macOS.

Les guides sont d'abord publiés en anglais. Les traductions suivront ; en attendant, voici les versions originales.

APFS Snapshot: An APFS snapshot is a read-only, point-in-time copy of a volume, used by Time Machine and updates and valuable for recovering earlier file states.
APFS (Apple File System): APFS is Apple's copy-on-write file system used by macOS since High Sierra, with containers, volumes, snapshots and nanosecond timestamps.
Biome: Biome is Apple's newer activity telemetry framework that stores event streams in SEGB files, progressively replacing knowledgeC.db on macOS.
fseventsd (FSEvents): fseventsd is the macOS daemon that records file system change events to the per-volume .fseventsd directory, a key source for file activity history.
Gatekeeper: Gatekeeper is the macOS security feature that checks code signing and notarization of quarantined software before it is allowed to run.
knowledgeC.db: knowledgeC.db is the CoreDuet SQLite database where macOS logs user and device activity such as app usage, focus and display state over time.
launchd: launchd is the macOS init and service manager (PID 1) that starts daemons and agents from property lists, a primary persistence location.
Mac Absolute Time: Mac Absolute Time (Cocoa Core Data time) counts seconds since 2001-01-01 00:00:00 UTC; add 978307200 to convert it to a Unix timestamp.
Quarantine Attribute (com.apple.quarantine): com.apple.quarantine is the extended attribute macOS adds to downloaded files, recording flags, a timestamp, the downloading app and an event UUID.
Sealed System Volume (SSV): The Sealed System Volume is the cryptographically hashed, read-only macOS system volume introduced in Big Sur, booted from a verified snapshot.
TCC (Transparency, Consent, and Control): TCC is the macOS privacy framework that governs app access to protected resources like Full Disk Access, camera, microphone and screen recording.
Unified Logs: Unified Logs are the macOS system logging facility since Sierra, stored in tracev3 files and queried with the log command or a .logarchive.