macOS Collections

AIR supports the following macOS Evidence and Artifacts

macOS Evidence List

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	Arc Bookmarks	Yes	Yes	No
2	Applications	Arc Browsing History	Yes	Yes	No
3	Applications	Arc Cookies	Yes	Yes	No
4	Applications	Arc Downloads	Yes	Yes	No
5	Applications	Arc Favicons	Yes	Yes	No
6	Applications	Arc Form History	Yes	Yes	No
7	Applications	Arc Local Storage	Yes	Yes	No
8	Applications	Arc Login Data	Yes	Yes	No
9	Applications	Arc Sessions	Yes	Yes	No
10	Applications	Arc Thumbnails	Yes	Yes	No
11	Applications	Arc User Profiles	Yes	Yes	No
12	Applications	Arc Web Storage	Yes	Yes	No
13	Applications	Brave Bookmarks	Yes	Yes	No
14	Applications	Brave Browsing History	Yes	Yes	No
15	Applications	Brave Cookies	Yes	Yes	No
16	Applications	Brave Downloads	Yes	Yes	No
17	Applications	Brave Favicons	Yes	Yes	No
18	Applications	Brave Form History	Yes	Yes	No
19	Applications	Brave Local Storage	Yes	Yes	No
20	Applications	Brave Login Data	Yes	Yes	No
21	Applications	Brave Sessions	Yes	Yes	No
22	Applications	Brave Thumbnails	Yes	Yes	No
23	Applications	Brave User Profiles	Yes	Yes	No
24	Applications	Brave Web Storage	Yes	Yes	No
25	Applications	Chrome Bookmarks	Yes	Yes	No
26	Applications	Chrome Browsing History	Yes	Yes	No
27	Applications	Chrome Cookies	Yes	Yes	No
28	Applications	Chrome Downloads	Yes	Yes	No
29	Applications	Chrome Extensions	Yes	Yes	No
30	Applications	Chrome Favicons	Yes	Yes	No
31	Applications	Chrome Form History	Yes	Yes	No
32	Applications	Chrome Local Storage	Yes	Yes	No
33	Applications	Chrome Login Data	Yes	Yes	No
34	Applications	Chrome Sessions	Yes	Yes	No
35	Applications	Chrome Thumbnails	Yes	Yes	No
36	Applications	Chrome User Profiles	Yes	Yes	No
37	Applications	Chrome Web Storage	Yes	Yes	No
38	Applications	Default Browser	Yes	Yes	No
39	Applications	Docker Changes	Yes	Yes	No
40	Applications	Docker Container Logs	Yes	Yes	No
41	Applications	Docker Containers	Yes	Yes	No
42	Applications	Docker Image History	Yes	Yes	No
43	Applications	Docker Images	Yes	Yes	No
44	Applications	Docker Info	Yes	Yes	No
45	Applications	Docker Networks	Yes	Yes	No
46	Applications	Docker Processes	Yes	Yes	No
47	Applications	Docker Volumes	Yes	Yes	No
48	Applications	Dump Arc Indexed DB	Yes	Yes	No
49	Applications	Dump Brave Indexed DB	Yes	Yes	No
50	Applications	Dump Chrome Indexed DB	Yes	Yes	No
51	Applications	Dump Edge Indexed DB	Yes	Yes	No
52	Applications	Dump Opera Indexed DB	Yes	Yes	No
53	Applications	Dump QQ Indexed DB	Yes	Yes	No
54	Applications	Dump Vivaldi Indexed DB	Yes	Yes	No
55	Applications	Edge Bookmarks	Yes	Yes	No
56	Applications	Edge Browsing History	Yes	Yes	No
57	Applications	Edge Cookies	Yes	Yes	No
58	Applications	Edge Downloads	Yes	Yes	No
59	Applications	Edge Extensions	Yes	Yes	No
60	Applications	Edge Favicons	Yes	Yes	No
61	Applications	Edge Form History	Yes	Yes	No
62	Applications	Edge Local Storage	Yes	Yes	No
63	Applications	Edge Login Data	Yes	Yes	No
64	Applications	Edge Sessions	Yes	Yes	No
65	Applications	Edge Thumbnails	Yes	Yes	No
66	Applications	Edge User Profiles	Yes	Yes	No
67	Applications	Edge Web Storage	Yes	Yes	No
68	Applications	Firefox Browsing History	Yes	Yes	No
69	Applications	Firefox Cookies	Yes	Yes	No
70	Applications	Firefox Downloads	Yes	Yes	No
71	Applications	Firefox Extensions	Yes	Yes	No
72	Applications	Opera Bookmarks	Yes	Yes	No
73	Applications	Opera Browsing History	Yes	Yes	No
74	Applications	Opera Cookies	Yes	Yes	No
75	Applications	Opera Downloads	Yes	Yes	No
76	Applications	Opera Extensions	Yes	Yes	No
77	Applications	Opera Favicons	Yes	Yes	No
78	Applications	Opera Form History	Yes	Yes	No
79	Applications	Opera Local Storage	Yes	Yes	No
80	Applications	Opera Login Data	Yes	Yes	No
81	Applications	Opera Sessions	Yes	Yes	No
82	Applications	Opera Thumbnails	Yes	Yes	No
83	Applications	Opera User Profiles	Yes	Yes	No
84	Applications	Opera Web Storage	Yes	Yes	No
85	Applications	QQ Bookmarks	Yes	Yes	No
86	Applications	QQ Browsing History	Yes	Yes	No
87	Applications	QQ Cookies	Yes	Yes	No
88	Applications	QQ Downloads	Yes	Yes	No
89	Applications	QQ Favicons	Yes	Yes	No
90	Applications	QQ Form History	Yes	Yes	No
91	Applications	QQ Local Storage	Yes	Yes	No
92	Applications	QQ Login Data	Yes	Yes	No
93	Applications	QQ Sessions	Yes	Yes	No
94	Applications	QQ Thumbnails	Yes	Yes	No
95	Applications	QQ User Profiles	Yes	Yes	No
96	Applications	QQ Web Storage	Yes	Yes	No
97	Applications	Safari Browsing History	Yes	Yes	No
98	Applications	Safari Downloads	Yes	Yes	No
99	Applications	Vivaldi Bookmarks	Yes	Yes	No
100	Applications	Vivaldi Browsing History	Yes	Yes	No
101	Applications	Vivaldi Cookies	Yes	Yes	No
102	Applications	Vivaldi Downloads	Yes	Yes	No
103	Applications	Vivaldi Favicons	Yes	Yes	No
104	Applications	Vivaldi Form History	Yes	Yes	No
105	Applications	Vivaldi Local Storage	Yes	Yes	No
106	Applications	Vivaldi Login Data	Yes	Yes	No
107	Applications	Vivaldi Sessions	Yes	Yes	No
108	Applications	Vivaldi Thumbnails	Yes	Yes	No
109	Applications	Vivaldi User Profiles	Yes	Yes	No
110	Applications	Vivaldi Web Storage	Yes	Yes	No
111	Applications	Waterfox Browsing History	Yes	Yes	No
112	Applications	Waterfox Downloads	Yes	Yes	No
113	DiskFilesystem	.DS_Store Files	Yes	Yes	No
114	DiskFilesystem	.Trash	Yes	Yes	No
115	DiskFilesystem	Block Devices	Yes	Yes	No
116	DiskFilesystem	Collect File System (FS) Events	Yes	Yes	No
117	DiskFilesystem	DMG File Opened	Yes	Yes	No
118	DiskFilesystem	Disk Encryption	Yes	Yes	No
119	DiskFilesystem	Extended Attributes	Yes	Yes	No
120	DiskFilesystem	File Last Used	Yes	Yes	No
121	DiskFilesystem	File System Enumeration	Yes	Yes	No
122	DiskFilesystem	Finder Mounted Volume	Yes	Yes	No
123	DiskFilesystem	Mount	Yes	Yes	No
124	DiskFilesystem	Parse File System (FS) Events	Yes	Yes	No
125	Network	DHCP Settings	Yes	Yes	No
126	Network	DNS Resolvers	Yes	Yes	No
127	Network	ETC Hosts	Yes	Yes	No
128	Network	ETC Protocols	Yes	Yes	No
129	Network	ETC Services	Yes	Yes	No
130	Network	IP Routes	Yes	Yes	No
131	Network	Listening Ports	Yes	Yes	No
132	Network	Network Interfaces	Yes	Yes	No
133	Network	Network Usage	Yes	Yes	No
134	Network	SSH Authorized Keys	Yes	Yes	No
135	Network	SSH Configs	Yes	Yes	No
136	Network	SSH Known Hosts	Yes	Yes	No
137	Network	SSHD Configs	Yes	Yes	No
138	Network	Wireless Network Connections	Yes	Yes	No
139	System	Apple Audit Logs	Yes	Yes	No
140	System	Apple System Logs (ASL)	Yes	Yes	No
141	System	Application Usage	Yes	Yes	No
142	System	Auto Loaded Processes	Yes	Yes	No
143	System	Bluetooth Connections	Yes	Yes	No
144	System	Command Line Activity	Yes	Yes	No
145	System	Crashes	Yes	Yes	No
146	System	Cron Jobs	Yes	Yes	No
147	System	Dock Items	Yes	Yes	No
148	System	Document Revisions	Yes	Yes	No
149	System	Downloaded Files Information	Yes	Yes	No
150	System	ETC Files	No	Yes	Yes
151	System	Emond Clients	Yes	Yes	No
152	System	Event Taps	Yes	Yes	No
153	System	Failed Sudo	Yes	Yes	No
154	System	Gatekeeper	Yes	Yes	No
155	System	Gatekeeper Approved Apps	Yes	Yes	No
156	System	Installed Applications	Yes	Yes	No
157	System	Kernel Extensions	Yes	Yes	No
158	System	Kernel Extensions Info	Yes	Yes	No
159	System	Keyboard Dictionary	Yes	Yes	No
160	System	Keychain	Yes	Yes	No
161	System	Launchd Files	No	Yes	Yes
162	System	Launchd Overrides	Yes	Yes	No
163	System	Logged Users	Yes	Yes	No
164	System	Login Hooks	Yes	Yes	No
165	System	Login Items	Yes	Yes	No
166	System	Logind	Yes	Yes	No
167	System	Logout Hooks	Yes	Yes	No
168	System	Mail Rules	Yes	Yes	No
169	System	Manuel Configuration Profile Install	Yes	Yes	No
170	System	Most Recently Used (MRU)	Yes	Yes	No
171	System	Network Capture	No	Yes	No
172	System	NetworkFlow	No	Yes	No
173	System	Notification Info	Yes	Yes	No
174	System	PCAP	No	Yes	No
175	System	Package Install History	Yes	Yes	No
176	System	Print Jobs	Yes	Yes	No
177	System	Printer Info	Yes	Yes	No
178	System	Processes	Yes	Yes	No
179	System	Quarantine Events	Yes	Yes	No
180	System	Quick Look Cache	Yes	Yes	No
181	System	Re-Opened Apps	Yes	Yes	No
182	System	SSH Files	No	Yes	Yes
183	System	Screensharing	Yes	Yes	No
184	System	Session Creation and Destruction	Yes	Yes	No
185	System	Shared File List	Yes	Yes	No
186	System	Shell History	Yes	Yes	No
187	System	Software Update Information	Yes	Yes	No
188	System	Spotlight Metadata	Yes	Yes	Yes
189	System	Sshd	Yes	Yes	No
190	System	Sudo Last Run	Yes	Yes	No
191	System	System Extension Info	Yes	Yes	No
192	System	System Integrity Protection Status	Yes	Yes	No
193	System	Tccd	Yes	Yes	No
194	System	Transparency, Consent, and Control (TCC)	Yes	Yes	No
195	System	USB Info	Yes	Yes	No
196	System	User Groups	Yes	Yes	No
197	System	Users	Yes	Yes	No
198	System	XProtect Remediation	Yes	Yes	No
199	System	iMessage	Yes	Yes	Yes

macOS Artifact List:

#	Category	Evidence (click for details)	Parsed	Sent to the Investigation Hub	Source Files Collected
1	Applications	AnyDesk Logs	No	No	Yes
2	Applications	Apache Logs	No	No	Yes
3	Applications	Discord Desktop Cache	No	No	Yes
4	Applications	Docker Logs	No	No	Yes
5	Applications	Homebrew Logs	No	No	Yes
6	Applications	MongoDB Logs	No	No	Yes
7	Applications	MySQL Logs	No	No	Yes
8	Applications	NGINX Logs	No	No	Yes
9	Applications	Parallels Logs	No	No	Yes
10	Applications	PostgreSQL Logs	No	No	Yes
11	Applications	Sophos Events Database	No	No	Yes
12	Applications	Sophos Logs	No	No	Yes
13	Applications	Splashtop Mac Logs	No	No	Yes
14	Applications	Teamviewer Logs	No	No	Yes
15	Network	Wifi Logs	No	No	Yes
16	System	Install Logs	No	No	Yes
17	System	KnowledgeC	No	No	Yes
18	System	System Logs	No	No	Yes