Mac Remote Access Forensics

← Canonical HubThis page is part of the Mac Forensics cluster. Return to the hub for the full artifact index and cross-cluster context.

Quick Answer. Mac Remote Access Forensics reconstructs incoming and outgoing remote sessions by combining Unified Log entries in com.apple.screensharing, com.apple.sshd, and com.apple.RemoteDesktop, service enablement plists (/Library/Preferences/com.apple.RemoteManagement.plist, com.apple.screensharing.plist, com.apple.RemoteLogin.plist), third-party tool application databases and logs, and — for outbound sessions — ~/.ssh/known_hosts and LSSharedFileList.RecentHosts.sfl2.

Apple Screen Sharing and Apple Remote Desktop

Artifact	Path / source	Contents
com.apple.screensharing Unified Log	log show subsystem	Client IP, session start/end, authenticated user
com.apple.RemoteDesktop Unified Log	log show subsystem	ARD-specific events, task push, screen observe
ARD kickstart preferences	/Library/Preferences/com.apple.RemoteManagement.plist	Whether ARD is enabled, allowed users, privileges
Screen Sharing preferences	/Library/Preferences/com.apple.screensharing.plist	Whether Screen Sharing is enabled
ARD reports	/var/db/RemoteManagement/	Task reports pushed to and from the Mac
SecurityAgent auth	securityagent subsystem	Prompts that appeared for the remote user

SSH — the most common remote pathway

• com.apple.sshd Unified Log — every attempted and successful SSH connection with source IP, user, method (publickey / password), and disconnect reason.
• /etc/ssh/sshd_config — was Password auth allowed? RootLogin permitted? PubkeyAcceptedKeyTypes?
• /private/var/db/com.apple.xpc.launchd/disabled.plist — indicates whether com.openssh.sshd is enabled.
• Per-user ~/.ssh/authorized_keys — public keys authorized to log in. Compare comments and mtime to authorized use.
• Per-user ~/.ssh/known_hosts and ~/.ssh/config — outbound SSH targets the user has connected to.

VNC and third-party remote support tools

We inventory known remote-access tools by bundle ID and inspect their per-app databases:

• TeamViewer — ~/Library/Application Support/TeamViewer/Logs/, Connections.txt, Connections_incoming.txt
• AnyDesk — ~/Library/Application Support/AnyDesk/ ad_svc.trace, connection_trace.txt
• LogMeIn — /Library/Application Support/LogMeIn/ log directory
• Chrome Remote Desktop — host log under ~/Library/Logs/chrome_remote_desktop/
• Splashtop, Zoho Assist, ScreenConnect — each has a per-app connection log
• RealVNC, TigerVNC — VNC listener processes visible in the com.apple.launchd Unified Log

Presence of these tools where the account holder does not remember installing them — especially when correlated with an unexplained TCC screen-recording grant — is a strong indicator of unauthorized third-party remote support tooling.

Correlating remote access to actions on the Mac

Once a remote session window is established, we correlate it to KnowledgeC.db /app/inFocus (which apps were used during the remote session), /display/isBacklit (whether the local user could have seen the screen), and any file activity on the source volume during that same window. This produces a complete narrative: “at HH:MM:SS an SSH session from <IP> authenticated as user <X>, Terminal became frontmost within Y seconds, and files <A, B, C> were subsequently accessed.”

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions