macOS Forensic Artifacts: Plist Files, Keychain and Time Machine

APFS is common on modern macOS systems, while HFS+ and other formats can still appear on older or external media. A purchase year or OS-family label is not sufficient to classify every attached device.

An APFS container provides storage shared by volumes, subject to its actual configuration. Physical stores, partitions, synthesised devices, volume groups and individual volumes are different layers. Map the actual topology rather than assume /dev/disk1 always represents a complete physical source.

Select acquisition scope for the question and accessible data. A volume acquisition can omit other volumes or container-level structures; a raw physical acquisition may still contain encrypted information that is not independently usable. Preserve the layout, mount/access state, source identity and the supported method’s limits.

APFS uses copy-on-write metadata and supports clones and snapshots. This does not guarantee that every overwritten file version remains recoverable. Retained snapshots can preserve referenced earlier content, while deallocation, deleted snapshots, encryption and later activity can limit recovery.

Apple-silicon and T2-equipped systems use hardware-linked security mechanisms relevant to access and key handling. Storage removal or chip reading is not a universal route to decrypted data. Verify the actual hardware and acquisition capability instead of transferring an older Intel workflow to every Mac.

launchd manages many system and user-session jobs. It is an important persistence source, but macOS has other mechanisms too; legacy scheduling, login items, service-management APIs and application-specific behaviour should not be assumed absent.

Common launch-configuration locations include /Library/LaunchDaemons, /Library/LaunchAgents and a user’s ~/Library/LaunchAgents. System locations and other registration records need appropriate examination as well. A system job’s effective user and behaviour follow its definition and launch context, not just the directory name.

Inspect relevant keys such as Label, Program or ProgramArguments, RunAtLoad, KeepAlive and scheduling conditions where present. Resolve the actual executable and arguments, check provenance and compare with a suitable baseline. A short interval or unusual directory name is a lead, not a unique exfiltration signature.

Background-task management records and their paths change across macOS versions. Use support for the actual format rather than identify one historical backgrounditems.btm path as universal. Registration, enablement and evidence of execution are separate questions.

Filesystem protections and a sealed system volume constrain changes under their actual settings. They do not make every system-path record inherently benign or every change impossible. Preserve security configuration and relevant logs; do not alter settings simply to obtain a cleaner-looking inventory.

Property lists store structured values rather than necessarily one top-level key-value dictionary. XML and binary encodings can represent supported strings, numbers, dates, data, arrays and dictionaries. An application may additionally use an archived-object schema requiring more than a generic value dump.

On an analysis copy, plutil -p provides a human-readable view, and plutil can write an XML conversion to a separate destination or standard output. Python plistlib supports XML and binary property lists. Preserve the original bytes, tool version and any conversion rather than overwrite the evidence file.

Preferences, recent-item data, Dock configuration and some network settings are useful categories, but paths and schemas vary. A familiar plist does not necessarily contain every visited network, AirDrop transfer or application action. Check the actual version and whether data also resides in databases or other records.

Live preferences can be cached or updated asynchronously. Do not flush settings, log out a user or modify a preference merely to make an artefact appear consistent. Document the capture state and compare appropriate file, cache or snapshot sources where available.

An SSID, BSSID or Bluetooth reference does not independently prove physical location, a completed connection or human participation. Record the source’s actual semantics, retention and alternative explanations.

Keychain-related storage can contain particular passwords, keys, certificates or other items, depending on the account, application and protection model. It is not a universal database of every credential or token used on a Mac.

Item accessibility can depend on authentication, access controls, entitlements and hardware-linked protections. A login password, a FileVault recovery credential and Keychain access are different mechanisms; possession of one does not automatically decrypt every item in another.

FileVault protects access to encrypted volume data under the actual platform’s design. On Apple-silicon and T2 Macs, the Secure Enclave participates in key handling. Verify any supported acquisition and recovery route; a generic RAM image is not guaranteed to contain an extractable master key or password.

iCloud Keychain is end-to-end encrypted and Apple states that it cannot read its contents. Provider-held account data, legally disclosed data and data accessible through a properly authorised trusted device or supported recovery mechanism are separate categories. A legal request does not itself remove encryption.

Organisational FileVault recovery arrangements depend on configuration and escrow. They do not constitute universal Keychain recovery. Record the exact credential or access mechanism used, its authority, the source and which data became available. Protect recovered secrets and disclose only relevant material.

Time Machine destination backups and local snapshots are different sources. Their existence, schedule, storage format and retained history depend on configuration, software and available space. Inventory actual snapshots and backup sets; do not infer that a particular day or deleted file must be preserved.

A snapshot is a point-in-time filesystem view with shared storage relationships, not a full independent physical-disk image. Its read-only nature does not by itself authenticate the earlier events or identify who changed a file.

Unified Logging can preserve structured records with privacy handling, levels and retention controls. Collect appropriate supporting resources for a supported parser, not only an isolated tracev3 file. Some values may be redacted, unavailable or unretained.

Queries using the log utility or offline processing with a supported tool need their scope, predicates, version and time basis recorded. A log excerpt is not proof that every launch, network event or authorisation action was captured.

Spotlight records indexed metadata under its actual indexing coverage. It is not a complete content or filename history for every volume. A live search against a mounted source can behave differently from parsing an acquired store and can affect the examination environment.

FSEvents supplies path-related change information under its actual generation and retention conditions. Events can be coalesced, dropped or require rescanning; it is not an operation-by-operation transcript. Event IDs and flags do not independently name the responsible process or person.

Combine these sources according to their different meanings. A stored path change, an indexed filename and an email record can prompt further examination without proving one causal sequence or eliminating a compromise hypothesis.

User Library locations can hold application support, preferences, caches, containers and group-container data. Paths and access protections vary by application and OS version. Identify actual profiles and accounts instead of treating one directory template as exhaustive.

Browser databases, session files and credentials have separate schemas and protection. A retained history entry does not prove a deliberate visit by a particular person, and absence after a clear-history action does not guarantee either complete erasure or recovery.

Messages records can include a chat.db database and associated attachments, with relationships depending on schema and synchronisation. Preserve relevant SQLite database, WAL and supporting files through a suitable method. A WAL fragment is not a guaranteed intact deleted message or a fixed recovery window.

Cloud-synchronised locations may contain complete files, placeholders, metadata or only selected locally hydrated content. ~/Library/Mobile Documents and other provider-related locations do not prove that everything in an iCloud account was acquired. Establish sync settings, local availability and separate cloud scope.

Notes, Photos libraries and other application stores need their own relationships and supporting resources preserved. A Photos library is a bundle represented as a directory on disk; copying only visible media may omit relevant database or metadata.

For shared database and application considerations, continue to Web Browser Forensics. Legal authority, access and disclosure requirements vary by jurisdiction; do not equate an unlocked user session with unrestricted authority.