ARTIFACT CATALOGUE
Every artifact macfor can collect.
Each entry links to a forensic reference covering data sources, parser internals and analysis tips.
- Artifacts
- 36
- Categories
- 11
All artifacts
shell.historyShell HistoryCommand-line history from Bash, Zsh, Fish, and POSIX sh, revealing user activity and potential indicators of compromise.shelluserbrowser.safariSafari BrowserComplete Safari browser artifacts including browsing history, downloads, bookmarks, cookies, extensions, and session data.browserusersystem.usersUser AccountsLocal macOS account records from directory services, including hidden and service accounts, with creation, password-change and failed-login times. Password hashes are never collected.systemuserbrowser.chromeChrome BrowserGoogle Chrome browser artifacts including history, downloads, bookmarks, cookies, saved passwords, extensions, and session data.browseruserbrowser.firefoxFirefox BrowserMozilla Firefox browser artifacts including history, bookmarks, cookies, saved logins, form data, and session storage.browseruserbrowser.arcArc BrowserArc browser artifacts including browsing history, cookies, saved logins, bookmarks, Spaces, pinned tabs, Boosts and preferences.browseruserfilesystem.fseventsFSEventsmacOS File System Events journal providing detailed file activity records for timeline analysis and incident response.filesystemsystemsystem.unifiedlogsUnified LogsmacOS Unified Logging system (tracev3) containing system, application, and security events.systemsystem.spotlightSpotlight MetadatamacOS Spotlight search shortcuts, preferences, volume configuration, and opt-in raw index stores.systemfilesystemcontacts.addressbookContactsApple Contacts (AddressBook) database containing contact records, group memberships, change tracking, and per-source account databases.communicationusermail.appleApple MailApple Mail artifacts including the Envelope Index database, EMLX message files, account configuration, and Apple Intelligence metadata.communicationusermessages.appleMessagesApple Messages database containing iMessage, SMS, MMS, and RCS conversations, attachment metadata, reactions, and references to recently deleted messages.communicationuserfacetime.appleFaceTimeFaceTime and phone call history including call records, group participants, and FaceTime Links for shareable meeting URLs.communicationusernetwork.wifiWiFi Known NetworksWiFi connection history including known networks, BSSID geolocation data, DHCP leases, and network interface configuration.networksystemnotes.appleApple NotesApple Notes database containing note content, folders, attachments, embedded tables, collaboration data, and change history.productivityusersystem.keychainKeychainmacOS Keychain metadata including generic passwords, internet passwords, certificates, and cryptographic keys — without exposing secret data.securitysystemdevtools.iterm2iTerm2iTerm2 terminal forensics — shell-integration command and directory history, remote hosts, profiles with SSH configuration, saved session state, and Python automation scripts.developmentshellsystem.quicklookQuick Look ThumbnailsQuick Look thumbnail cache containing thumbnail metadata, file access records, and extracted bitmap images from previewed files.systemfilesystemai.claudedesktopClaude DesktopClaude Desktop forensics: cached conversations recovered from three local sources, Cowork agent sessions with an HMAC-chained audit log, MCP servers and extensions.aicommunicationai.chatgptChatGPTChatGPT desktop forensics: local threads in plaintext with every tool call and command, cached cloud conversations and images, automations and hooks.aicommunicationsystem.patternoflifePattern of LifeBehavioural analytics from KnowledgeC, Biome, Screen Time, InteractionC, and DuetActivityScheduler — tracking app usage, device activity, and interaction patterns.systemuserpim.calendarCalendar & RemindersApple Calendar events with participants, locations, and recurrences, plus Reminders with triggers, tags, and per-account databases.productivityusersystem.persistencePersistence MechanismsmacOS persistence mechanisms — LaunchAgents, LaunchDaemons, login items, cron, periodic, and login/logout hooks. Critical for malware analysis and account compromise investigations.systemsecuritysystem.tccTCC DatabaseTransparency, Consent, and Control (TCC) database — records every privacy permission grant and deny on macOS. Essential for understanding what an application could access.systemsecuritysystem.coreanalyticsCoreAnalyticsmacOS CoreAnalytics diagnostic events — process launches, app crashes, daemon activity, and system telemetry retained for ~28 days.systemsystem.quarantineQuarantine EventsLaunchServices Quarantine Events database — every file downloaded by a quarantine-aware app, with timestamp, originating URL, and triggering bundle ID.systemsecuritysystem.screentimeScreen TimeApple Screen Time configuration and activity — restrictions, downtime, users, devices, installed apps, ask-for-time requests, notification counts, and pickups.systemuserdevices.bluetoothBluetooth DevicesBluetooth pairing and connection history — paired device records, device identifiers, audio connections, and radio state.systemnetworkmessaging.signalSignal DesktopSignal Desktop messaging artifacts — encrypted SQLCipher database, attachment cache, and configuration metadata.communicationusermessaging.telegramTelegram DesktopTelegram Desktop artifacts — tdata inventory, account and session files, cached media, secret-chat traces, and crash logs.communicationusermessaging.whatsappWhatsApp DesktopWhatsApp Desktop artifacts — chat database, contacts, attachments, and account metadata from the macOS Catalyst app.communicationusermessaging.fbmessengerFacebook MessengerFacebook Messenger desktop artifacts — Lightspeed SQLite databases holding messages, threads, contacts, calls and payments, plus cached media.communicationusercommunication.slackSlackSlack desktop artifacts — workspace metadata, cached messages, authentication tokens, cache, and logs. Critical for enterprise investigations.communicationuserapp.discordDiscord DesktopDiscord desktop artifacts — server and DM cache, authentication tokens, and downloaded media from the Electron client.communicationusercloudstorage.dropboxDropboxDropbox desktop artifacts — local file cache, deleted-file records, account configuration, and app preferences.filesystemuserproductivity.evernoteEvernoteEvernote desktop artifacts — notes, notebooks, attachment metadata and web clips from v10+ and legacy SQLite databases.productivityuser
Collect just one artifact
Every entry's plugin id works with --plugin.