Launchd
Definition
macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and ~/Library/LaunchAgents.
- Platform
- macOS
- Role
- System and user service supervisor
- Replaces
- init, cron, SysV-RC
- Config locations
- /Library/LaunchDaemons, /Library/LaunchAgents, ~/Library/LaunchAgents
Common questions
Why do forensic examiners check launchd plist files during macOS incident response?+
Persistence mechanisms and malware often register a LaunchDaemon or LaunchAgent to auto-start at boot or login, so reviewing these plist files reveals what programs are configured to run automatically, including unauthorized or suspicious entries.
What is the difference between a LaunchDaemon and a LaunchAgent for investigative purposes?+
A LaunchDaemon runs as root regardless of user login and typically resides in a system-level directory, while a LaunchAgent runs in a specific user's context after login, so the distinction helps an examiner scope whether a persistence mechanism is system-wide or tied to one user account.
Related terms
- APFS
- Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes...
- Keychain
- Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the...
- Property List (Plist)
- Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login...
- Time Machine
- Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and...
- Unified Logging
- macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of...