macOS Forensics

• macOS Forensics
  • Quick Commands
  • Acquisition Notes
  • System and Version Info
  • Users and Authentication
  • Persistence
  • Unified Logs (macOS 10.12+)
  • Execution and Process Artifacts
  • File System and Timestamps
  • Browser and Internet Activity
  • Network
  • Persistence-Adjacent User Artifacts
  • Key SQLite Databases (query with sqlite3)

Quick Commands

sudo sysdiagnose -f /tmp/                      # broad system snapshot
sudo log collect --output /tmp/logs.logarchive # unified logs
launchctl list                                 # loaded jobs
system_profiler SPApplicationsDataType         # installed apps
sudo fdesetup status                           # FileVault state
csrutil status                                 # SIP state
spctl --status                                 # Gatekeeper state

Acquisition Notes

• SIP blocks access to protected paths on a live system you must image the disk or boot to recovery.
• FileVault: obtain recovery key or user password; decrypt before imaging offline.
• T2 / Apple Silicon: internal storage is hardware-encrypted; live/logical acquisition or target disk mode with credentials very likely required. No raw physical dump without keys. Quite often on and enabled by default.
• Prefer log collect and sysdiagnose for volatile/unified log capture on live hosts.
• Full triage: consider macOS UnifiedLogs, AutoMacTC, aftermath (Jamf), or mac_apt.

System and Version Info

Artifact	Path
OS version	/System/Library/CoreServices/SystemVersion.plist
Serial / hardware	system_profiler SPHardwareDataType
Setup / install date	/var/db/.AppleSetupDone, /var/log/install.log
Timezone	/Library/Preferences/.GlobalPreferences.plist
Hostname	scutil --get ComputerName / HostName / LocalHostName

Users and Authentication

Artifact	Path
User accounts	/var/db/dslocal/nodes/Default/users/*.plist
Password hashes (ShadowHashData)	user plist above → ShadowHashData key
Last login	last, /var/log/wtmp (legacy), utmpx
Login window prefs	/Library/Preferences/com.apple.loginwindow.plist
Auto-login	/etc/kcpassword (XOR-obfuscated password)
Sudo activity	/var/log/system.log, unified logs
Keychains	~/Library/Keychains/, /Library/Keychains/System.keychain

Persistence

Mechanism	Path
LaunchDaemons	/Library/LaunchDaemons/, /System/Library/LaunchDaemons/
LaunchAgents	/Library/LaunchAgents/, ~/Library/LaunchAgents/, /System/Library/LaunchAgents/
Login items	~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
BTM (Ventura+)	/private/var/db/com.apple.backgroundtaskmanagement/
Cron	/usr/lib/cron/tabs/, /etc/crontab
Periodic scripts	/etc/periodic/, /etc/periodic.conf
Config profiles	/var/db/ConfigurationProfiles/
Kernel extensions	/Library/Extensions/, /System/Library/Extensions/
System extensions	/Library/SystemExtensions/
Emond (deprecated)	/etc/emond.d/, /private/var/db/emondClients/
Dylib hijacking	check DYLD_* env vars, otool -L

Unified Logs (macOS 10.12+)

Task	Command
Live stream	log stream
Historical	log show --last 1d
Predicate filter	log show --predicate 'eventMessage CONTAINS "ssh"'
From archive	log show --archive <path>.logarchive
Log store location	/var/db/diagnostics/, /var/db/uuidtext/
Collect	sudo log collect --output out.logarchive

Execution and Process Artifacts

Artifact	Path / Notes
Quarantine (downloaded files)	~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 (SQLite)
XProtect	/Library/Apple/System/Library/CoreServices/XProtect.bundle
Gatekeeper / GKE db	/var/db/SystemPolicy, /var/db/gke.bundle
Spotlight metadata	.Spotlight-V100/, mdls <file>
App usage / knowledge	~/Library/Application Support/Knowledge/knowledgeC.db (SQLite)
DYLD shared cache	usage inferable via unified logs
Crash / diagnostic reports	~/Library/Logs/DiagnosticReports/, /Library/Logs/DiagnosticReports/
Install history	/Library/Receipts/InstallHistory.plist

File System and Timestamps

Item	Notes
File system	APFS (HFS+ legacy)
Timestamps	stat -x <file> — btime/mtime/atime/ctime
Extended attributes	xattr -l <file> (esp. com.apple.metadata:kMDItemWhereFroms)
Where-from URL	xattr -p com.apple.metadata:kMDItemWhereFroms <file> (plist)
Trash	~/.Trash/, ~/.Trashes
APFS snapshots	tmutil listlocalsnapshots /, diskutil apfs listSnapshots
FileVault	fdesetup status; recovery key escrow

Browser and Internet Activity

Browser	Path (relative to ~/Library/)
Safari history	Safari/History.db (SQLite)
Safari downloads	Safari/Downloads.plist
Safari tabs	Safari/LastSession.plist
Chrome	Application Support/Google/Chrome/Default/History
Firefox	Application Support/Firefox/Profiles/*/places.sqlite
Cookies	Cookies/Cookies.binarycookies (Safari)

Network

Artifact	Path / Command
Interfaces / config	/Library/Preferences/SystemConfiguration/preferences.plist
Known Wi-Fi networks	/Library/Preferences/com.apple.wifi.known-networks.plist
Airport / Wi-Fi	/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
DHCP leases	/var/db/dhcpclient/leases/
Firewall (ALF)	/Library/Preferences/com.apple.alf.plist
ARP / connections (live)	arp -a, netstat -an, lsof -i

Persistence-Adjacent User Artifacts

Artifact	Path (relative to ~/Library/)
Recent items	Application Support/com.apple.sharedfilelist/
Dock config	Preferences/com.apple.dock.plist
Bash/Zsh history	~/.bash_history, ~/.zsh_history
SSH	~/.ssh/ (keys, known_hosts, authorized_keys)
Terminal saved state	Saved Application State/com.apple.Terminal.savedState/
Notes	Group Containers/group.com.apple.notes/NoteStore.sqlite
Messages	Messages/chat.db (SQLite)
Mail	Mail/

Key SQLite Databases (query with sqlite3)

• knowledgeC.db — app focus, usage, device activity
• QuarantineEventsV2 — download provenance
• chat.db — iMessage/SMS
• NoteStore.sqlite — Notes (may be gzip-compressed BLOBs)
• Browser History / places.sqlite — web activity
• ~/Library/Application Support/CallHistoryDB/CallHistory.storedata