Skip to content
FSEvents Parser

Series

Investigating with FSEvents

2 posts in this series. Read them in order or jump to any one.

  1. Dating FSEvents Records Without Timestamps

    FSEvents records have no time. How to build honest time windows from .fseventsd log file modification times, uuid files and dated paths, and when they fail.

  2. FSEvents Investigation: A Mac Exfiltration Walkthrough

    A fictional macOS intrusion traced with FSEvents alone: a download, a LaunchAgent, Full Disk Access, a hidden staging folder, a USB stick and the cleanup.

All posts in this series