Transparency, Consent, and Control (TCC)
Overview
Evidence: Transparency, Consent, and Control (TCC)
Description: Collect Transparency, Consent, and Control Information
Category: System
Platform: macos
Short Name: tcc
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
TCC is macOS’s privacy framework managing application permissions to sensitive resources (camera, microphone, files, etc.). This data is essential for auditing privacy decisions and detecting over‑permissive apps.
Data Collected
This collector gathers structured data about transparency, consent, and control (tcc).
Transparency, Consent, and Control (TCC) Data
| Field | Description | Example |
|---|---|---|
User | User | Example value |
Service | Service | Example value |
Client | Client | Example value |
AuthReason | Auth Reason | Example value |
AuthValue | Auth Value | Example value |
LastModified | Last Modified | 2023-10-15 14:30:25+03:00 |
Collection Method
This collector copies TCC databases from system and user paths and parses the access table to extract service, client, reason, and value.
Forensic Value
This evidence is crucial for forensic investigations as it reveals which apps were granted or denied sensitive permissions and when, assisting in identifying privacy abuses.