macOS FSEvents Forensics: What .fseventsd Proves
What the macOS FSEvents log records, where .fseventsd lives, what it can and cannot prove, and how to read it without exact timestamps.
Posts tagged: #dfir
Dating FSEvents Records Without Timestamps
FSEvents records have no time. How to build honest time windows from .fseventsd log file modification times, uuid files and dated paths, and when they fail.