macOS Forensics

What it is and why it matters

Macs are common in design studios, media companies, start-ups and senior management, which is exactly where intellectual property and financial disputes arise. They are examined less often than Windows machines, so many laboratories have less practice with them, and the platform has changed more in the last few years than Windows has. APFS replaced HFS+, the unified log replaced plain text logs, the system volume became sealed and read-only and Apple silicon brought iPhone-style data protection to the laptop.

The good news is that macOS records a great deal about user activity. FSEvents logs every change to the file system. The unified log keeps millions of entries with microsecond timestamps. Quarantine records show where every downloaded file came from. KnowledgeC and its successors track application use and device state. Spotlight indexes content and metadata. Together these give a picture of a user's day that is often richer than on Windows.

The difficult part is getting at the data. On an Apple silicon Mac the storage is soldered to the board and encrypted with keys tied to the Secure Enclave. There is no drive to remove and no way to read it without the user's credentials or a recovery key. Acquisition therefore starts with authority and credentials, and the examiner must be honest about what cannot be reached without them.

Types of digital evidence

APFS Structures and Snapshots
The container with its volumes, the System and Data volume group, local Time Machine snapshots and APFS snapshots that preserve files as they stood hours or days earlier.
Unified Log
Binary tracev3 files under /private/var/db/diagnostics with their string tables in /private/var/db/uuidtext. They record logins, unlocks, USB and network events, app launches and system activity in great detail, read with the log command or a parser.
FSEvents Records
Compressed logs in the hidden .fseventsd folder on each volume that list file system changes by path, including on external drives, with the order of events preserved.
Property Lists
Thousands of plist files under /Library and ~/Library holding preferences, recent items, login items, Wi-Fi networks, Bluetooth pairings and the configuration of almost every application.
Application Usage Databases
KnowledgeC.db under ~/Library/Application Support/Knowledge, the Biome stores that have taken over much of its role in recent versions and the TCC database that records which apps were granted access to the camera, microphone, files and screen.
Download and Quarantine Records
The com.apple.quarantine extended attribute on downloaded files and the LaunchServices QuarantineEventsV2 database, which log the source URL, the downloading application and the time.
User Data Stores
Safari's History.db and Downloads.plist, Messages in chat.db, Mail under ~/Library/Mail, Notes in NoteStore.sqlite, Photos.sqlite in the Photos library and the Keychain database that holds saved passwords and tokens.
Persistence Items
LaunchAgents and LaunchDaemons in /Library and ~/Library, login items recorded in the background items database, cron entries and configuration profiles.

Devices and data sources

Apple silicon MacBooks and desktops, with soldered, encrypted storage that must be acquired through the running system or Recovery with credentials
Intel Macs with the T2 chip, where the internal SSD is encrypted by the chip and cannot be read in another machine
Older Intel Macs with removable SSDs that can be imaged through a write-blocker
Time Machine backups on external drives and network shares
iCloud data linked to the Apple Account, reached only through a separate legal process
Local iPhone and iPad backups stored by Finder under ~/Library/Application Support/MobileSync
External drives formatted as APFS or HFS+, which carry their own FSEvents and Spotlight records
Memory captures where the Mac was running and a supported method was available

How an examination runs

The order matters. Each step protects the one after it.

01
Establish Access
Identify the model, the chip and whether FileVault is on. Confirm the lawful basis and obtain the user password, the FileVault recovery key or institutional recovery key where one exists. On Apple silicon there is no useful acquisition without one of these.
02
Handle a Running Mac With Care
If the Mac is unlocked, keep it awake and powered, record the screen state and consider a live collection of volatile data before anything else. Sleep and lock can put the data out of reach.
03
Acquire Through a Supported Route
Image a removable SSD through a write-blocker where the model allows. For Apple silicon and T2 Macs, acquire from macOS Recovery or through a logical collection on the running system, using credentials under authority, and hash the result.
04
Collect Targeted Artefacts
Where a full image is impossible, collect the unified log, FSEvents, plists, databases and snapshots by a documented script so that the collection can be repeated and explained.
05
Decode the Formats
Convert binary plists, parse the unified log and FSEvents and open the SQLite stores with their write-ahead logs. Use Apple's own tools on a matching macOS version for the unified log where possible.
06
Mount the Snapshots
List and mount APFS and Time Machine snapshots to recover earlier file versions and deleted items, and compare them with the live volume.
07
Correlate and Report
Join unlock events, application launches, file changes, downloads and device connections into one timeline, convert timestamps from Apple's epoch and state what the acquisition route could not reach.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

APFS: Apple File System, used on every Mac since 2017. It supports containers with several volumes, snapshots, cloning and native encryption, and stores timestamps in nanoseconds.
Volume Group: The pairing of a sealed, read-only System volume with a writable Data volume that together appear as one Macintosh HD. User data and most evidence live on the Data volume.
FileVault: Apple's volume encryption. On Apple silicon and T2 Macs the storage is always encrypted by hardware and FileVault adds the user's password to the key hierarchy, so the data is unreadable without it.
Secure Enclave: The security processor in Apple silicon and T2 chips that holds the keys for storage encryption and enforces password attempt limits. It is the reason a soldered SSD cannot be read elsewhere.
Unified Log: The logging system that replaced syslog and ASL on macOS. Entries are stored in binary tracev3 files and can be read with the log command or forensic parsers.
FSEvents: The file system event service that records changes by path for Spotlight and Time Machine. Its logs persist on the volume and show renames, deletions and creations without timestamps of their own.
Quarantine: An extended attribute macOS adds to downloaded files so that Gatekeeper can check them before they open. For the examiner it preserves the download URL and application.
Cocoa Timestamp: Seconds since 1 January 2001, used in many Apple databases. It is 978307200 seconds behind the Unix epoch, and mixing the two shifts dates by 31 years.
TCC: Transparency, Consent and Control, the framework that records user permission grants to applications in TCC.db. It shows which apps could capture the screen or read the user's files.

Challenges and limits

What makes it hard

Apple silicon and T2 Macs cannot be imaged by removing the drive, and nothing useful is readable without the user's credentials or a recovery key
A locked or sleeping Mac may need the password again, and some data is protected until the next login even on an unlocked machine
The unified log is huge, partly in binary and depends on string tables that may be missing from a partial collection
Artefact locations and databases change with each macOS release, and KnowledgeC is being replaced by Biome stores that tools decode unevenly
Apple's own tools read the unified log best, but they need a Mac of a matching version, which the laboratory may not have
iCloud sync moves photos, messages, notes and files off the device and into a separate legal process
Few laboratories handle Macs daily, so procedures, validation and experience are thinner than for Windows

Keeping the evidence intact

Record the model, chip, macOS version, FileVault state and the acquisition route before collecting anything
Where credentials are used to acquire, log who supplied them, under what authority and every action taken on the live machine
Hash every collected file and the image or container as a whole, and keep the collection script with its version
Preserve snapshots as they were found and note which snapshot each recovered file came from
Convert Apple timestamps with a documented method and check a known event against the user's own records

Standards and legal considerations

ISO/IEC 27037:2012
The collection and preservation guideline, including live acquisition where a device cannot be powered down without losing access.
Read the guide
NIST SP 800-86
The general process for collecting and examining operating system data, which a Mac examination follows with its own artefact list.
Read the guide
SWGDE Best Practices
SWGDE guidance on computer forensic acquisition and on Mac-specific collection issues such as encrypted and soldered storage.
Read the guide
ISO/IEC 27041:2015
Assurance that the methods used are fit for purpose, which matters when a logical collection with credentials replaces a full image.
Read the guide

In practice

The Designer's Last Week
A design firm suspects a departing designer took client files. The quarantine database shows nothing, but FSEvents on the Data volume records the client folder being copied to a volume named after a personal drive, and the unified log shows a USB mass storage device connected at that minute. A Time Machine snapshot confirms the folder's contents on that day.
Screen Recording Without Consent
An employee says a colleague recorded private calls. On the colleague's Mac the TCC database shows screen recording permission granted to a small utility two weeks earlier, LaunchAgents include an entry for it and the unified log records the app starting at each meeting time.
A MacBook With No Password
An Apple silicon MacBook arrives with FileVault on, the user unavailable and no recovery key escrowed. The examiner documents the model and state, confirms that no acquisition route exists without the credentials and recommends a lawful request for the password or the Apple Account recovery key rather than any attempt to bypass it.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

StorageDigital Storage ForensicsSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.AdvancedDCFA

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

Careers that use it

Computer Forensic Analyst

Questions people ask

Can a Mac's drive be removed and imaged?

Only on older Intel models. Apple silicon and T2 Macs have soldered storage that is encrypted by the security chip, so the drive cannot be read in another machine. Acquisition happens through the Mac itself, with credentials, under authority.

Is FileVault always on?

Not by default on every Mac, but the hardware encryption underneath it is. Without FileVault the Mac will boot and expose the data to anyone with the machine. With FileVault the user's password or recovery key is needed. The examiner records which state applies.

Where does macOS record what applications were used?

In the unified log, in KnowledgeC and the newer Biome stores and in the Spotlight and LaunchServices databases. Each covers a different period and a different level of detail, so they are read together.

Does deleting a file remove it from a Mac?

Not immediately. APFS snapshots, Time Machine local snapshots, Spotlight metadata and FSEvents records can all survive the deletion, and the content may remain in unallocated space until the SSD erases it.