Mark McKinnon has written a plugin that will export the /.fseventsd directory to the temp folder and will then call an executable program that will parse the data into a SQLite database and import it into Autopsy into the Extracted Content area. Learn more about the plugin here.

Load More Related Articles
  • FSEParser v 2.1 released

    New version of FSEventsParser has been released. FSEvents files are written to disk by OS …
  • Volatility Workbench Beta

    PassMark Software has released a beta version of Volatility Workbench – a graphical …
  • Autopsy 4.4.0 is out!

    The new version of our favorite open source forensic tool – Autopsy, – has bee…
Load More In Software

Leave a Reply

Your email address will not be published. Required fields are marked *