FSEventsParser – Parser for OSX/iOS FSEvents Logs

FSEvents files are written to disk by macOS APIs and contain historical records of file system activity that occurred for a particular volume. They can be found on devices running macOS and devices that were plugged in to a device running macOS. They are GZIP format, so you can also try carving for GZIPs to find FSEvents files that may be unallocated.

FSEventsParser can be used to parse FSEvents files from the ‘/.fseventsd/’ on a live system or FSEvents files extracted from an image. Carved GZIP files from a macOS volume or a device that was plugged into a macOS system can also be parsed. The parser outputs parsed information to tab delimited txt files and an SQLite database. Errors and exceptions are recorded in the exceptions logfile.

FSEventsParser - Parser for OSX/iOS FSEvents Logs

FSEventsParser – Parser for OSX/iOS FSEvents Logs

The report_queries.json file can be used to generate custom reports based off of SQLite queries. Use -q to specify the file’s location when running the parser. it will be possible to create your own targeted reports by editing the ‘report_queries.json’ file or just get default targeted reports including:

  • User Profile Activity
  • Trash Activity
  • Browser Activity
  • Downloads Activity
  • Mount Activity
  • Email Attachments
  • Users Picture Type Files
  • Users Document Type Files
  • DropBox Activity
  • Box_com Activity

You can download and read more about this tool over here: https://github.com/dlcowen/

Notify of
Inline Feedbacks
View all comments