https://cpus.me/tags/forensics/ Recent content in Forensics on cpus.me Hugo en-us Sat, 08 Aug 2026 00:30:00 +0200 https://cpus.me/2026/macos-forensic-artifacts/ Sat, 08 Aug 2026 00:30:00 +0200 https://cpus.me/2026/macos-forensic-artifacts/ <p>A searchable index of 313 macOS forensic artifacts collectable from a live system, covering macOS 13 Ventura through macOS 26. Each entry records where the artifact lives, how to collect it, what privilege the collection requires, and what investigative question it answers.</p> <p>Root alone is not sufficient on macOS 13 and later. TCC applies regardless of uid, so a root process without Full Disk Access gets <code>EPERM</code> on Mail, Messages, Safari data, the user&rsquo;s Desktop, Documents and Downloads, and on <code>TCC.db</code> itself. Every entry declares its access tier, so you can filter for exactly what a given privilege level can reach.</p>