- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic reconstruction of file creation, modification, access, and deletion on Mac systems. FSEvents journals, Spotlight metadata, .DS_Store, quarantine, and APFS local snapshots recover activity even after Trash empty and user attempts to remove evidence.
Quick Answer. Mac File Activity Forensics combines FSEvents journals (/.fseventsd/) recording every filesystem change per volume, Spotlight metadata (.Spotlight-V100/) with kMDItem attributes, per-folder .DS_Store caches, Trash metadata (~/.Trash/.DS_Store and /.Trashes/<uid>/), Quarantine and WhereFroms extended attributes, and APFS local snapshots that preserve prior file states. Together these establish what existed, what changed, when, and where files came from — even after deletion.
/.fseventsd/ stores compressed gzip records of every change to a volume: created, removed, renamed, modified, and inode metadata updates. Each record carries an event ID (monotonic 64-bit), a path relative to the volume, and a flags bitmask (ItemCreated, ItemRemoved, ItemRenamed, ItemModified, ItemInodeMetaMod, ItemIsFile, ItemIsDir, ItemXattrMod).
FSEvents survives Trash empty and file overwrite because it records the path — not the file. In exfiltration matters, FSEvents on the source volume plus FSEvents on the external volume (see USB Forensics) together prove the copy occurred.
Spotlight populates rich metadata for every indexed file, readable with mdls:
kMDItemFSCreationDate, kMDItemFSContentChangeDate, kMDItemLastUsedDatekMDItemWhereFroms — the URL(s) the file was downloaded fromkMDItemDownloadedDate — when the file arrived from networkkMDItemAuthors, kMDItemContentCreator, kMDItemContentTypekMDItemUseCount, kMDItemUsedDates — how often the file was openedThese attributes are also stored as extended attributes on the file itself (com.apple.metadata:kMDItemWhereFroms), which survive movement to other Mac volumes.
| Artifact | Location | What it establishes |
|---|---|---|
| Per-user Trash | ~/.Trash/ | Files pending permanent delete, with original path in extended attribute |
| Per-volume Trash | /Volumes/ | Trash on external / secondary volumes |
| .DS_Store in Trash | ~/.Trash/.DS_Store | Ordered list including previously deleted items |
| FSEvents ItemRemoved | /.fseventsd/ | Path deleted, event ID, timestamp |
| APFS local snapshots | tmutil listlocalsnapshots / | Prior file state — the deleted file itself, not just its record |
| Time Machine | External / network backup volume | Full file recovery up to backup horizon |
Files downloaded from the network receive the com.apple.quarantine extended attribute containing the download UUID, agent name, event date, and originating URL. The system-wide quarantine database at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 is a SQLite file with a row per download recording origin URL, referrer URL, sender name, and timestamp. Together with kMDItemWhereFroms, this artifact answers “where did this file come from and when.”
APFS creates automatic local snapshots roughly hourly (retained ~24 hours) and on Time Machine backup events. Snapshots are copy-on-write — files “deleted” from the live volume remain intact within the snapshot until the snapshot itself is deleted. tmutil listlocalsnapshots / enumerates them; we mount each snapshot read-only during acquisition and preserve every recoverable version of the relevant files. Where users have run tmutil deletelocalsnapshots, the underlying blocks remain in APFS free space until overwritten — carving is often successful.
Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.
Frequently yes, via APFS local snapshots (up to ~24 hours) and Time Machine backups. Beyond that, carving from unallocated APFS space can recover files if the blocks were not overwritten.
FSEvents records the event and path, not the user. We attribute the action by correlating with KnowledgeC.db /app/inFocus at the same timestamp (which app was frontmost) and Unified Log entries from Finder or Terminal.
srm was deprecated on APFS because SSD wear-leveling makes secure delete unreliable. On APFS, the appropriate defense is FileVault; and evidence of an attempt to secure-erase itself leaves shell history and Unified Log entries.
Tell us about the Mac, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder