Mac Application Usage & Execution Forensics

Quick Answer. Mac Application Usage Forensics answers “did this program run, and by whom” using KnowledgeC.db /app/inFocus and /app/usage streams, LaunchServices (com.apple.LaunchServices.QuarantineEventsV2 and ~/Library/Preferences/com.apple.LaunchServicesPrefs.plist), the UnifiedLog com.apple.launchd and com.apple.xpc.launchd subsystems, Spotlight kMDItemLastUsedDate, XProtect and Gatekeeper decisions, and — when available — ExecPolicy ES-endpoint events on macOS 11+.

KnowledgeC.db — the primary evidence of app usage

Each /app/inFocus row in KnowledgeC.db (~/Library/Application Support/Knowledge/knowledgeC.db) is a start/end interval a specific bundle identifier was frontmost, per user. Because the DB retains ~30 days of data and cannot be edited without root, it is the single most conclusive evidence of interactive app usage.

Related streams: /app/usage (aggregated), /app/activity (with declared document / URL), /app/webUsage (Safari), /app/intents (Siri-suggested).

LaunchServices, quarantine, and first-run

• ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 — SQLite of every quarantined item with origin URL and event date.
• com.apple.quarantine extended attribute on the binary — carries the flag until the user approves the app on first run, at which point the flag changes and the timestamp updates.
• com.apple.macl extended attribute — Mandatory Access Control List entries added when apps are granted TCC permissions.
• /private/var/db/com.apple.xpc.launchd/disabled.501.plist — user-disabled LaunchAgents.

Gatekeeper, XProtect, and code-signing decisions

macOS Gatekeeper decisions are logged under the com.apple.syspolicy subsystem — every “verifying ” and “allowed / denied” pair is recorded. spctl --assess -vv <path> reproduces the decision offline. XProtect updates and detections appear under com.apple.XProtectFramework.PluginAPI. Where the ExecPolicy database (/var/db/SystemPolicy) is preserved, it lists every notarized binary that has run on the machine.

Command-line execution — Terminal, zsh, and scripts

• ~/.zsh_history and ~/.zsh_sessions/ — default zsh history since macOS 10.15 with timestamps when EXTENDED_HISTORY is enabled.
• ~/.bash_history — legacy.
• KnowledgeC.db /app/inFocus for com.apple.Terminal and com.googlecode.iterm2 — proves an interactive shell was in front.
• Unified Log com.apple.launchd service invocations from LaunchAgents / Daemons.
• AppleScript execution — osascript invocations recorded in the process lineage.

Ruling programs in or out

A defense-favorable outcome commonly relies on demonstrating a program did not run. We show negative evidence by enumerating: (a) absence of the bundle ID in KnowledgeC.db, (b) absence of a QuarantineEventsV2 row, (c) absence of Spotlight kMDItemLastUsedDate on the binary, and (d) absence of com.apple.launchd invocation. Reports state confidence explicitly and describe the coverage window that supports the conclusion.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions