New version of FSEventsParser has been released. FSEvents files are written to disk by OS X apis and contain historical records of events that occurred for the partition. They are stored in the root of the partition within the directory ‘/.fseventsd/’. FSEvent files can be found on the OS X system partition and can also be found on external storage devices that were plugged in to a computer running OS X.

 

Load More Related Articles
  • Volatility Workbench Beta

    PassMark Software has released a beta version of Volatility Workbench – a graphical …
  • Mac FS Events Parser for Autopsy

    Mark McKinnon has written a plugin that will export the /.fseventsd directory to the temp …
  • Autopsy 4.4.0 is out!

    The new version of our favorite open source forensic tool – Autopsy, – has bee…
Load More In Software

Leave a Reply

Your email address will not be published. Required fields are marked *