Document Revisions

Overview

Evidence: Document Revisions Description: Collect Document Revisions Category: System Platform: macos Short Name: drvs Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

macOS DocumentRevisions-V100 stores prior versions of documents for autosave. This data is essential for recovering prior content and tracking edits over time.

Data Collected

This collector gathers structured data about document revisions.

Document Revisions Data

Field	Description	Example
FileINode	File I Node	123
StorageID	Storage ID	123
FilePath	File Path	Example value
ExistsOnDisk	Exists On Disk	true
FileLastSeen	File Last Seen	2023-10-15 14:30:25+03:00
GenerationAdded	Generation Added	2023-10-15 14:30:25+03:00
GenerationPath	Generation Path	Example value
Source	Source	Example value

Collection Method

This collector copies the DocumentRevisions database and queries for files and generations, recording into document_revisions.

Forensic Value

This evidence is crucial for forensic investigations as it can reveal previous versions of altered or deleted documents.