macOS Collections

AIR supports the following macOS Evidence and Artifacts

macOS Evidence List

#

Category

Evidence (click for details)

Parsed

Sent to the Investigation Hub

Source Files Collected

1

Applications

Yes

Yes

No

2

Applications

Yes

Yes

No

3

Applications

Yes

Yes

No

4

Applications

Yes

Yes

No

5

Applications

Yes

Yes

No

6

Applications

Yes

Yes

No

7

Applications

Yes

Yes

No

8

Applications

Yes

Yes

No

9

Applications

Yes

Yes

No

10

Applications

Yes

Yes

No

11

Applications

Yes

Yes

No

12

Applications

Yes

Yes

No

13

Applications

Yes

Yes

No

14

Applications

Yes

Yes

No

15

Applications

Yes

Yes

No

16

Applications

Yes

Yes

No

17

Applications

Yes

Yes

No

18

Applications

Yes

Yes

No

19

Applications

Yes

Yes

No

20

Applications

Yes

Yes

No

21

Applications

Yes

Yes

No

22

Applications

Yes

Yes

No

23

Applications

Yes

Yes

No

24

Applications

Yes

Yes

No

25

Applications

Yes

Yes

No

26

Applications

Yes

Yes

No

27

Applications

Yes

Yes

No

28

Applications

Yes

Yes

No

29

Applications

Yes

Yes

No

30

Applications

Yes

Yes

No

31

Applications

Yes

Yes

No

32

Applications

Yes

Yes

No

33

Applications

Yes

Yes

No

34

Applications

Yes

Yes

No

35

Applications

Yes

Yes

No

36

Applications

Yes

Yes

No

37

Applications

Yes

Yes

No

38

Applications

Yes

Yes

No

39

Applications

Yes

Yes

No

40

Applications

Yes

Yes

No

41

Applications

Yes

Yes

No

42

Applications

Yes

Yes

No

43

Applications

Yes

Yes

No

44

Applications

Yes

Yes

No

45

Applications

Yes

Yes

No

46

Applications

Yes

Yes

No

47

Applications

Yes

Yes

No

48

Applications

Yes

Yes

No

49

Applications

Yes

Yes

No

50

Applications

Yes

Yes

No

51

Applications

Yes

Yes

No

52

Applications

Yes

Yes

No

53

Applications

Yes

Yes

No

54

Applications

Yes

Yes

No

55

Applications

Yes

Yes

No

56

Applications

Yes

Yes

No

57

Applications

Yes

Yes

No

58

Applications

Yes

Yes

No

59

Applications

Yes

Yes

No

60

Applications

Yes

Yes

No

61

Applications

Yes

Yes

No

62

Applications

Yes

Yes

No

63

Applications

Yes

Yes

No

64

Applications

Yes

Yes

No

65

Applications

Yes

Yes

No

66

Applications

Yes

Yes

No

67

Applications

Yes

Yes

No

68

Applications

Yes

Yes

No

69

Applications

Yes

Yes

No

70

Applications

Yes

Yes

No

71

Applications

Yes

Yes

No

72

Applications

Yes

Yes

No

73

Applications

Yes

Yes

No

74

Applications

Yes

Yes

No

75

Applications

Yes

Yes

No

76

Applications

Yes

Yes

No

77

Applications

Yes

Yes

No

78

Applications

Yes

Yes

No

79

Applications

Yes

Yes

No

80

Applications

Yes

Yes

No

81

Applications

Yes

Yes

No

82

Applications

Yes

Yes

No

83

Applications

Yes

Yes

No

84

Applications

Yes

Yes

No

85

Applications

Yes

Yes

No

86

Applications

Yes

Yes

No

87

Applications

Yes

Yes

No

88

Applications

Yes

Yes

No

89

Applications

Yes

Yes

No

90

Applications

Yes

Yes

No

91

Applications

Yes

Yes

No

92

Applications

Yes

Yes

No

93

Applications

Yes

Yes

No

94

Applications

Yes

Yes

No

95

Applications

Yes

Yes

No

96

Applications

Yes

Yes

No

97

Applications

Yes

Yes

No

98

Applications

Yes

Yes

No

99

Applications

Yes

Yes

No

100

Applications

Yes

Yes

No

101

Applications

Yes

Yes

No

102

Applications

Yes

Yes

No

103

Applications

Yes

Yes

No

104

Applications

Yes

Yes

No

105

Applications

Yes

Yes

No

106

Applications

Yes

Yes

No

107

Applications

Yes

Yes

No

108

Applications

Yes

Yes

No

109

Applications

Yes

Yes

No

110

Applications

Yes

Yes

No

111

Applications

Yes

Yes

No

112

Applications

Yes

Yes

No

113

DiskFilesystem

Yes

Yes

No

114

DiskFilesystem

Yes

Yes

No

115

DiskFilesystem

Yes

Yes

No

116

DiskFilesystem

Yes

Yes

No

117

DiskFilesystem

Yes

Yes

No

118

DiskFilesystem

Yes

Yes

No

119

DiskFilesystem

Yes

Yes

No

120

DiskFilesystem

Yes

Yes

No

121

DiskFilesystem

Yes

Yes

No

122

DiskFilesystem

Yes

Yes

No

123

DiskFilesystem

Yes

Yes

No

124

DiskFilesystem

Yes

Yes

No

125

Network

Yes

Yes

No

126

Network

Yes

Yes

No

127

Network

Yes

Yes

No

128

Network

Yes

Yes

No

129

Network

Yes

Yes

No

130

Network

Yes

Yes

No

131

Network

Yes

Yes

No

132

Network

Yes

Yes

No

133

Network

Yes

Yes

No

134

Network

Yes

Yes

No

135

Network

Yes

Yes

No

136

Network

Yes

Yes

No

137

Network

Yes

Yes

No

139

System

Yes

Yes

No

140

System

Yes

Yes

No

141

System

Yes

Yes

No

142

System

Yes

Yes

No

143

System

Yes

Yes

No

144

System

Yes

Yes

No

145

System

Yes

Yes

No

146

System

Yes

Yes

No

147

System

Yes

Yes

No

148

System

Yes

Yes

No

150

System

No

Yes

Yes

151

System

Yes

Yes

No

152

System

Yes

Yes

No

153

System

Yes

Yes

No

154

System

Yes

Yes

No

155

System

Yes

Yes

No

156

System

Yes

Yes

No

157

System

Yes

Yes

No

158

System

Yes

Yes

No

159

System

Yes

Yes

No

160

System

Yes

Yes

No

161

System

No

Yes

Yes

162

System

Yes

Yes

No

163

System

Yes

Yes

No

164

System

Yes

Yes

No

165

System

Yes

Yes

No

166

System

Yes

Yes

No

167

System

Yes

Yes

No

168

System

Yes

Yes

No

170

System

Yes

Yes

No

171

System

No

Yes

No

172

System

No

Yes

No

173

System

Yes

Yes

No

174

System

No

Yes

No

175

System

Yes

Yes

No

176

System

Yes

Yes

No

177

System

Yes

Yes

No

178

System

Yes

Yes

No

179

System

Yes

Yes

No

180

System

Yes

Yes

No

181

System

Yes

Yes

No

182

System

No

Yes

Yes

183

System

Yes

Yes

No

185

System

Yes

Yes

No

186

System

Yes

Yes

No

188

System

Yes

Yes

Yes

189

System

Yes

Yes

No

190

System

Yes

Yes

No

191

System

Yes

Yes

No

193

System

Yes

Yes

No

195

System

Yes

Yes

No

196

System

Yes

Yes

No

197

System

Yes

Yes

No

198

System

Yes

Yes

No

199

System

Yes

Yes

Yes

macOS Artifact List:

#

Category

Evidence (click for details)

Parsed

Sent to the Investigation Hub

Source Files Collected

1

Applications

No

No

Yes

2

Applications

No

No

Yes

3

Applications

No

No

Yes

4

Applications

No

No

Yes

5

Applications

No

No

Yes

6

Applications

No

No

Yes

7

Applications

No

No

Yes

8

Applications

No

No

Yes

9

Applications

No

No

Yes

10

Applications

No

No

Yes

11

Applications

No

No

Yes

12

Applications

No

No

Yes

13

Applications

No

No

Yes

14

Applications

No

No

Yes

15

Network

No

No

Yes

16

System

No

No

Yes

17

System

No

No

Yes

18

System

No

No

Yes

Last updated

Was this helpful?