Not yet available in English

This page does not exist in English yet. Shown is the version in Deutsch.

macOS-Artefakte

Pages in this section

• Biome
• CFURL Cache
• FSEvents
• InteractionC
• KnowledgeC
• Notifications
• Quick Look Cache
• Recent Items
• Spotlight Datenbank
• Trashes Folder
• Unified Logs

Not covered yet

E.g. these entries are still missing. Contributions are welcome.

Program execution / app usage

• KnowledgeC
• Biome
• Saved Application State
• Bildschirmzeit (RMAdminStore)
• Dock
• Crash Reports
• ExecPolicy und Notarisierung

Installed software / apps

• Installationshistorie

File and folder access

• .DS_Store
• Spotlight Shortcuts

File existence and deletion

• Document Revisions
• CoreSpotlight

Location

• Ortungsdienste (clients.plist)

Communication

• InteractionC
• Nachrichten (chat.db)
• Mail
• Anrufliste und FaceTime
• Kontakte

Data transfer

• Quarantine Events
• AirDrop
• File Provider / iCloud Drive
• Druckaufträge (CUPS)

Commands and input

• Shell-Historie (zsh, bash)
• sudo lastrun
• Siri Analytics

Accounts and logon

• Benutzerkonten (dslocal)
• utmpx
• Internet-Accounts
• Keychain

Network and remote access

• WLAN
• Netzwerknutzung (netusage.sqlite)
• Remotezugriff (Apple Remote Desktop, Bildschirmfreigabe)
• Firewall-Log

Device state and usage

• Unified Logs
• PowerLog
• Apple System Log (ASL)
• Personalization Portrait

External devices and connections

• iOS-Kopplung und -Backups (lockdown, MobileSync)
• Bluetooth

System and configuration

• Systeminformationen
• TCC.db
• XProtect

Persistence / autostart

• Launch Agents und Launch Daemons
• Background Task Management (Anmeldeobjekte)

User content

• Fotos (Photos.sqlite)
• Notizen
• Kalender