File Last Used

Overview

Evidence: File Last Used Description: Collects files with last access times via Finder or open command. Platform: macOS Short Name: fls Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

macOS tracks last usage metadata for files through extended attributes (e.g., com.apple.lastuseddate#PS) updated by Finder and certain application interactions. These timestamps help understand user interaction with files beyond standard atime semantics.

Data Collected

This collector gathers structured data about file last used.

File Last Used Data

Field	Description	Example
ID	ID	1
Username	Username	Example Name
Path	Path	/path/to/file
Time	Time	2023-10-15 14:30:25

Collection Method

This collector enumerates user directories and extracts the com.apple.lastuseddate#PS extended attribute for files, decoding it into timestamps and mapping them to the owning user.

Usage

Last used timestamps help reconstruct user activity on documents, reveal recently interacted files, and support timeline building even when traditional access times are unreliable due to filesystem settings.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.