macOS Collections

macOS Evidence List

#	Evidence (click for details)	Category	Parsed	Sent to the Investigation Hub	Raw Files Collected
1	.DS_Store Files	DiskFilesystem	Yes	Yes	No
2	.Trash	DiskFilesystem	Yes	Yes	No
3	AI Agent Events	AI	Yes	Yes	No
4	AI Agents	AI	Yes	Yes	No
5	AI Artifacts	AI	No	Yes	Yes
6	AI Commands	AI	Yes	Yes	No
7	AI Configs	AI	Yes	Yes	No
8	AI Hooks	AI	Yes	Yes	No
9	AI MCP	AI	Yes	Yes	No
10	AI Models	AI	Yes	Yes	No
11	AI Rules	AI	Yes	Yes	No
12	AI Secrets	AI	Yes	Yes	No
13	AI Sessions	AI	Yes	Yes	No
14	AI Skills	AI	Yes	Yes	No
15	AnyDesk Logs	Applications	No	No	Yes
16	Apache Logs	Applications	No	No	Yes
17	Apple Audit Logs	System	Yes	Yes	No
18	Apple System Logs (ASL)	System	Yes	Yes	No
19	Application In Focus	System	Yes	Yes	No
20	Application Intents	System	Yes	Yes	No
21	Application Media Usage	System	Yes	Yes	No
22	Application Usage	System	Yes	Yes	No
23	Application Web Usage	System	Yes	Yes	No
24	Arc Bookmarks	Applications	Yes	Yes	No
25	Arc Browsing History	Applications	Yes	Yes	No
26	Arc Cookies	Applications	Yes	Yes	No
27	Arc Downloads	Applications	Yes	Yes	No
28	Arc Favicons	Applications	Yes	Yes	No
29	Arc Form History	Applications	Yes	Yes	No
30	Arc Local Storage	Applications	Yes	Yes	No
31	Arc Login Data	Applications	Yes	Yes	No
32	Arc Sessions	Applications	Yes	Yes	No
33	Arc Thumbnails	Applications	Yes	Yes	No
34	Arc User Profiles	Applications	Yes	Yes	No
35	Arc Web Storage	Applications	Yes	Yes	No
36	Audio Output Route	System	Yes	Yes	No
37	Auto Loaded Processes	System	Yes	Yes	No
38	Block Devices	DiskFilesystem	Yes	Yes	No
39	Bluetooth Connections	System	Yes	Yes	No
40	Brave Bookmarks	Applications	Yes	Yes	No
41	Brave Browsing History	Applications	Yes	Yes	No
42	Brave Cookies	Applications	Yes	Yes	No
43	Brave Downloads	Applications	Yes	Yes	No
44	Brave Favicons	Applications	Yes	Yes	No
45	Brave Form History	Applications	Yes	Yes	No
46	Brave Local Storage	Applications	Yes	Yes	No
47	Brave Login Data	Applications	Yes	Yes	No
48	Brave Sessions	Applications	Yes	Yes	No
49	Brave Thumbnails	Applications	Yes	Yes	No
50	Brave User Profiles	Applications	Yes	Yes	No
51	Brave Web Storage	Applications	Yes	Yes	No
52	Chrome Bookmarks	Applications	Yes	Yes	No
53	Chrome Browsing History	Applications	Yes	Yes	No
54	Chrome Cookies	Applications	Yes	Yes	No
55	Chrome Downloads	Applications	Yes	Yes	No
56	Chrome Extensions	Applications	Yes	Yes	No
57	Chrome Favicons	Applications	Yes	Yes	No
58	Chrome Form History	Applications	Yes	Yes	No
59	Chrome Local Storage	Applications	Yes	Yes	No
60	Chrome Login Data	Applications	Yes	Yes	No
61	Chrome Sessions	Applications	Yes	Yes	No
62	Chrome Thumbnails	Applications	Yes	Yes	No
63	Chrome User Profiles	Applications	Yes	Yes	No
64	Chrome Web Storage	Applications	Yes	Yes	No
65	Collect File System (FS) Events	DiskFilesystem	Yes	Yes	No
66	Command Line Activity	EventLogs	Yes	Yes	No
67	Crashes	System	Yes	Yes	No
68	Cron Jobs	System	Yes	Yes	No
69	DHCP Settings	Network	Yes	Yes	No
70	DMG File Opened	DiskFilesystem	Yes	Yes	No
71	DNS Resolvers	Network	Yes	Yes	No
72	Default Browser	Applications	Yes	Yes	No
73	Dependency Manifests	Applications	Yes	Yes	No
74	Device Battery Percentage	System	Yes	Yes	No
75	Device Locked State	System	Yes	Yes	No
76	Device Plugged In State	System	Yes	Yes	No
77	Discord Desktop Cache	Applications	No	No	Yes
78	Disk Encryption	DiskFilesystem	Yes	Yes	No
79	Dock Items	System	Yes	Yes	No
80	Docker Changes	Applications	Yes	Yes	No
81	Docker Container Logs	Applications	Yes	Yes	No
82	Docker Containers	Applications	Yes	Yes	No
83	Docker Image History	Applications	Yes	Yes	No
84	Docker Images	Applications	Yes	Yes	No
85	Docker Info	Applications	Yes	Yes	No
86	Docker Logs	Applications	No	No	Yes
87	Docker Networks	Applications	Yes	Yes	No
88	Docker Processes	Applications	Yes	Yes	No
89	Docker Volumes	Applications	Yes	Yes	No
90	Document Revisions	System	Yes	Yes	No
91	Downloaded Files Information	System	Yes	Yes	No
92	Dump Arc Indexed DB	Applications	Yes	Yes	No
93	Dump Brave Indexed DB	Applications	Yes	Yes	No
94	Dump Chrome Indexed DB	Applications	Yes	Yes	No
95	Dump Edge Indexed DB	Applications	Yes	Yes	No
96	Dump Opera Indexed DB	Applications	Yes	Yes	No
97	Dump QQ Indexed DB	Applications	Yes	Yes	No
98	Dump Vivaldi Indexed DB	Applications	Yes	Yes	No
99	ETC Files	System	No	Yes	Yes
100	ETC Hosts	Network	Yes	Yes	No
101	ETC Protocols	Network	Yes	Yes	No
102	ETC Services	Network	Yes	Yes	No
103	Edge Bookmarks	Applications	Yes	Yes	No
104	Edge Browsing History	Applications	Yes	Yes	No
105	Edge Cookies	Applications	Yes	Yes	No
106	Edge Downloads	Applications	Yes	Yes	No
107	Edge Extensions	Applications	Yes	Yes	No
108	Edge Favicons	Applications	Yes	Yes	No
109	Edge Form History	Applications	Yes	Yes	No
110	Edge Local Storage	Applications	Yes	Yes	No
111	Edge Login Data	Applications	Yes	Yes	No
112	Edge Sessions	Applications	Yes	Yes	No
113	Edge Thumbnails	Applications	Yes	Yes	No
114	Edge User Profiles	Applications	Yes	Yes	No
115	Edge Web Storage	Applications	Yes	Yes	No
116	Emond Clients	System	Yes	Yes	No
117	Event Taps	System	Yes	Yes	No
118	Extended Attributes	System	Yes	Yes	No
119	Failed Sudo	EventLogs	Yes	Yes	No
120	File Last Used	DiskFilesystem	Yes	Yes	No
121	File System Enumeration	DiskFilesystem	Yes	No	No
122	Finder Mounted Volume	DiskFilesystem	Yes	Yes	No
123	Firefox Browsing History	Applications	Yes	Yes	No
124	Firefox Cookies	Applications	Yes	Yes	No
125	Firefox Downloads	Applications	Yes	Yes	No
126	Firefox Extensions	Applications	Yes	Yes	No
127	Gatekeeper	System	Yes	Yes	No
128	Gatekeeper Approved Apps	System	Yes	Yes	No
129	Homebrew Logs	Applications	No	No	Yes
130	IP Routes	Network	Yes	Yes	No
131	IDE Extensions	Applications	Yes	Yes	No
132	Install Logs	System	No	No	Yes
133	Installed Applications	System	Yes	Yes	No
134	Kernel Extensions	EventLogs	Yes	Yes	No
135	Kernel Extensions Info	System	Yes	Yes	No
136	Keyboard Dictionary	System	Yes	Yes	No
137	Keychain	EventLogs	Yes	Yes	No
138	KnowledgeC	System	No	No	Yes
139	Launchd Files	System	No	Yes	Yes
140	Launchd Overrides	System	Yes	Yes	No
141	Listening Ports	Network	Yes	Yes	No
142	Logged Users	System	Yes	Yes	No
143	Login Hooks	System	Yes	Yes	No
144	Login Items	System	Yes	Yes	No
145	Logind	EventLogs	Yes	Yes	No
146	Logout Hooks	System	Yes	Yes	No
147	Mail Rules	System	Yes	Yes	No
148	Media Now Playing	System	Yes	Yes	No
149	Manuel Configuration Profile Install	EventLogs	Yes	Yes	No
150	MongoDB Logs	Applications	No	No	Yes
151	Most Recently Used (MRU)	System	Yes	Yes	No
152	Mount	DiskFilesystem	Yes	Yes	No
153	MySQL Logs	Applications	No	No	Yes
154	NGINX Logs	Applications	No	No	Yes
155	Network Interfaces	Network	Yes	Yes	No
156	Network Usage	Network	Yes	Yes	No
157	NetworkFlow	System	No	Yes	No
158	Notification Info	System	Yes	Yes	No
159	Opera Bookmarks	Applications	Yes	Yes	No
160	Opera Browsing History	Applications	Yes	Yes	No
161	Opera Cookies	Applications	Yes	Yes	No
162	Opera Downloads	Applications	Yes	Yes	No
163	Opera Extensions	Applications	Yes	Yes	No
164	Opera Favicons	Applications	Yes	Yes	No
165	Opera Form History	Applications	Yes	Yes	No
166	Opera Local Storage	Applications	Yes	Yes	No
167	Opera Login Data	Applications	Yes	Yes	No
168	Opera Sessions	Applications	Yes	Yes	No
169	Opera Thumbnails	Applications	Yes	Yes	No
170	Opera User Profiles	Applications	Yes	Yes	No
171	Opera Web Storage	Applications	Yes	Yes	No
172	PCAP	System	No	Yes	No
173	Package Install History	System	Yes	Yes	No
174	Parallels Logs	Applications	No	No	Yes
175	Parse File System (FS) Events	DiskFilesystem	Yes	Yes	No
176	PostgreSQL Logs	Applications	No	No	Yes
177	Print Jobs	System	Yes	Yes	No
178	Printer Info	System	Yes	Yes	No
179	Processes	System	Yes	Yes	No
180	QQ Bookmarks	Applications	Yes	Yes	No
181	QQ Browsing History	Applications	Yes	Yes	No
182	QQ Cookies	Applications	Yes	Yes	No
183	QQ Downloads	Applications	Yes	Yes	No
184	QQ Favicons	Applications	Yes	Yes	No
185	QQ Form History	Applications	Yes	Yes	No
186	QQ Local Storage	Applications	Yes	Yes	No
187	QQ Login Data	Applications	Yes	Yes	No
188	QQ Sessions	Applications	Yes	Yes	No
189	QQ Thumbnails	Applications	Yes	Yes	No
190	QQ User Profiles	Applications	Yes	Yes	No
191	QQ Web Storage	Applications	Yes	Yes	No
192	Quarantine Events	System	Yes	Yes	No
193	Quick Look Cache	System	Yes	Yes	No
194	Re-Opened Apps	System	Yes	Yes	No
195	SSH Authorized Keys	Network	Yes	Yes	No
196	SSH Configs	Network	Yes	Yes	No
197	SSH Files	System	No	Yes	Yes
198	SSH Known Hosts	Network	Yes	Yes	No
199	SSHD Configs	Network	Yes	Yes	No
200	Safari Browsing History	Applications	Yes	Yes	No
201	Safari Downloads	Applications	Yes	Yes	No
202	Screensharing	EventLogs	Yes	Yes	No
203	Session Creation and Destruction	EventLogs	Yes	Yes	No
204	Shared File List	System	Yes	Yes	No
205	Shell History	System	Yes	Yes	No
206	Software Update Information	System	Yes	Yes	No
207	Sophos Events Database	Applications	No	No	Yes
208	Sophos Logs	Applications	No	No	Yes
209	Splashtop Mac Logs	Applications	No	No	Yes
210	Spotlight	System	Yes	Yes	Yes
211	Sshd	EventLogs	Yes	Yes	No
212	Sudo Last Run	System	Yes	Yes	No
213	System Extension Info	System	Yes	Yes	No
214	System Integrity Protection Status	System	Yes	Yes	No
215	System Logs	System	No	No	Yes
216	Tccd	EventLogs	Yes	Yes	No
217	Teamviewer Logs	Applications	No	No	Yes
218	Transparency, Consent, and Control (TCC)	System	Yes	Yes	No
219	USB Info	System	Yes	Yes	No
220	User Groups	System	Yes	Yes	No
221	Users	System	Yes	Yes	No
222	Vivaldi Bookmarks	Applications	Yes	Yes	No
223	Vivaldi Browsing History	Applications	Yes	Yes	No
224	Vivaldi Cookies	Applications	Yes	Yes	No
225	Vivaldi Downloads	Applications	Yes	Yes	No
226	Vivaldi Favicons	Applications	Yes	Yes	No
227	Vivaldi Form History	Applications	Yes	Yes	No
228	Vivaldi Local Storage	Applications	Yes	Yes	No
229	Vivaldi Login Data	Applications	Yes	Yes	No
230	Vivaldi Sessions	Applications	Yes	Yes	No
231	Vivaldi Thumbnails	Applications	Yes	Yes	No
232	Vivaldi User Profiles	Applications	Yes	Yes	No
233	Vivaldi Web Storage	Applications	Yes	Yes	No
234	Waterfox Browsing History	Applications	Yes	Yes	No
235	Waterfox Downloads	Applications	Yes	Yes	No
236	Wifi Logs	Network	No	No	Yes
237	Wireless Network Connections	Network	Yes	Yes	No
238	XProtect Remediation	EventLogs	Yes	Yes	No
239	iMessage	System	Yes	Yes	Yes