.DS_Store Files
Overview
Evidence: .DS_Store Files
Description: Collect information about .DS_Store files.
Category: DiskFilesystem
Platform: macos
Short Name: dsstr
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
.DS_Store files store Finder metadata for directories. This data is essential for evidencing file presence and user interactions even after deletions.
Data Collected
This collector gathers structured data about .ds_store files.
.DS_Store Files Data
| Field | Description | Example |
|---|---|---|
Path | Path | Example value |
ModificationTime | Modification Time | 2023-10-15 14:30:25+03:00 |
AccessTime | Access Time | 2023-10-15 14:30:25+03:00 |
CreationTime | Creation Time | 2023-10-15 14:30:25+03:00 |
FileName | File Name | Example value |
StructureType | Structure Type | Example value |
DataType | Data Type | Example value |
Collection Method
This collector discovers .DS_Store files under user directories, parses entries, and records them into ds_store.
Forensic Value
This evidence is crucial for forensic investigations as it can indicate files that existed and how they were displayed in Finder.