FSEvents Parser — Blog https://www.fseventsparser.com/en/blog Latest from Blog en Wed, 30 Sep 2026 00:50:48 GMT Collect .fseventsd: tar, UAC, Aftermath, Velociraptor https://www.fseventsparser.com/en/blog/collect-fseventsd-tar-uac-velociraptor https://www.fseventsparser.com/en/blog/collect-fseventsd-tar-uac-velociraptor How to collect macOS FSEvents logs without losing their modification times: one tar command, UAC profiles, Aftermath, Velociraptor and disk images. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT FSEvents Investigation: A Mac Exfiltration Walkthrough https://www.fseventsparser.com/en/blog/fsevents-exfiltration-walkthrough https://www.fseventsparser.com/en/blog/fsevents-exfiltration-walkthrough A fictional macOS intrusion traced with FSEvents alone: a download, a LaunchAgent, Full Disk Access, a hidden staging folder, a USB stick and the cleanup. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT FSEvents File Format: 1SLD, 2SLD and 3SLD Pages https://www.fseventsparser.com/en/blog/fsevents-file-format-1sld-2sld-3sld https://www.fseventsparser.com/en/blog/fsevents-file-format-1sld-2sld-3sld The on-disk layout of macOS .fseventsd logs: gzip files, DLS page headers, record fields per version, and how to handle truncated or corrupt data. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT FSEvents Flags Explained: Every Bit, Decoded https://www.fseventsparser.com/en/blog/fsevents-flags-explained https://www.fseventsparser.com/en/blog/fsevents-flags-explained Every on-disk FSEvents flag bit with its value, the names FSEventsParser and mac_apt use, and how to read Created, Renamed, ItemCloned or EndOfTransaction. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT macOS FSEvents Forensics: What .fseventsd Proves https://www.fseventsparser.com/en/blog/fsevents-forensics-guide https://www.fseventsparser.com/en/blog/fsevents-forensics-guide What the macOS FSEvents log records, where .fseventsd lives, what it can and cannot prove, and how to read it without exact timestamps. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT Dating FSEvents Records Without Timestamps https://www.fseventsparser.com/en/blog/fsevents-timestamps-time-windows https://www.fseventsparser.com/en/blog/fsevents-timestamps-time-windows FSEvents records have no time. How to build honest time windows from .fseventsd log file modification times, uuid files and dated paths, and when they fail. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT