Keychain
Definition
Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the user's login password, a recovery key, or a RAM-extracted master key.
- Platform
- macOS
- Storage path
- ~/Library/Keychains/login.keychain-db
- Contents
- Passwords, Wi-Fi PSKs, private keys, certificates, secure notes
- Decryption requires
- Login password, recovery key, or RAM-extracted master key
Common questions
How can an examiner access Keychain contents without the user's login password?+
Live memory acquisition can sometimes recover the unlocked master key from RAM while the machine is running and the keychain is unlocked, and some forensic tools use a recovered FileVault or account password to derive the same key, but a locked machine with no captured credentials generally resists offline decryption.
Does deleting an app remove its stored Keychain entries?+
Not always. Many apps leave orphaned keychain items behind after uninstallation because the entries are tied to the app's bundle identifier rather than its presence on disk, so old credentials for removed software can still surface during a keychain examination.
Related terms
- APFS
- Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes...
- Launchd
- macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and...
- Property List (Plist)
- Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login...
- Time Machine
- Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and...
- Unified Logging
- macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of...