Mac Timeline & User Activity Analysis

← Canonical HubThis page is part of the Mac Forensics cluster. Return to the hub for the full artifact index and cross-cluster context.

Quick Answer. A Mac forensic timeline unifies every dated artifact across the system into a single ordered feed: FSEvents filesystem changes, Unified Log subsystem events, KnowledgeC.db app focus intervals, Spotlight kMDItem timestamps, browser history, quarantine downloads, USB attach/detach, login/logout, and Time Machine / APFS snapshot events. We build the timeline with tools such as mac_apt and plaso/log2timeline, then filter to the case window for the report.

The inputs to a Mac super timeline

Source	What it contributes
FSEvents (/.fseventsd/)	Per-path file create/modify/rename/delete with monotonic event ID
Unified Log (.tracev3)	Subsystem events: login, USB, SSH, screen share, launchd, kernel
KnowledgeC.db	App focus intervals, device lock state, backlight state
Spotlight kMDItem*	Content-creation and last-used dates for user documents
LSSharedFileList *.sfl2	Recently opened docs, apps, servers, volumes
QuarantineEventsV2	Downloads with origin URL and event date
Safari/Chrome/Firefox histories	Web activity per browser
ASL logs (older systems)	Authentication, install, kernel messages
auditd BSM trail (if enabled)	Full file and process audit
Time Machine backups	Prior file state across the retention window
APFS snapshots	Sub-daily local snapshots of the boot volume

How we build the timeline

1. Preserve. Acquire a write-blocked image or E01 of the boot volume plus .logarchive and Time Machine.
2. Normalize. Convert every artifact’s native timestamp to UTC. Mac Absolute Time (KnowledgeC.db) and CFAbsoluteTime differ from Unix time by 978307200 seconds — we adjust and document each conversion.
3. Enrich. Attach the user (short-name), app bundle ID, and volume UUID to each event where identifiable.
4. Correlate. Cluster events that share a second-precision window into a single narrative row (e.g. “USB attach → Finder frontmost → files copied → USB detach”).
5. Filter. Restrict to the case window; produce an exhibit-ready CSV or PDF the trier of fact can follow.

Anchoring narrative to Mac Absolute Time

Two Mac-specific epochs matter in timeline work:

• Mac Absolute Time / CFAbsoluteTime — seconds since 2001-01-01 00:00 UTC. Used by KnowledgeC.db, TCC.db, Safari History.db.
• Cocoa NSDate — same reference. python -c "import datetime; print(datetime.datetime(2001,1,1)+datetime.timedelta(seconds=X))" converts.

Every timestamp is annotated in the exhibit with the source epoch and the conversion applied.

Detecting anti-forensic gaps

• Missing FSEvents chunks that do not align with normal rollover — indicates rm -rf /.fseventsd/ or equivalent.
• KnowledgeC.db rows with ZSTARTDATE and ZENDDATE that do not align with Unified Log com.apple.launchd activity — indicates DB tampering.
• Time skew — check com.apple.system.timesync in the Unified Log for date changes; a manual clock adjustment is itself an event.
• APFS snapshot deletion via tmutil deletelocalsnapshots shows in the Unified Log; the deleted snapshot content may remain in unallocated blocks.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions