FS Events Collector

Overview

Evidence: FS Events Collector Description: Collect FS (File System) Events Category: System Platform: macOS Short Name: fsevnts Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

File System Events (FSEvents) are macOS's file system monitoring mechanism that tracks changes to files and directories in real-time. These events are stored in binary log files and provide detailed information about file operations including creation, modification, deletion, and access patterns.

FSEvents are essential for understanding file system activity, detecting unauthorized file access, and reconstructing file operations during forensic investigations. They provide a comprehensive audit trail of all file system changes on the system.

Data Collected

This collector gathers structured data about fs events collector.

Fs Events Collector Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Name	Record name	Example Record
Value	Record value	Example Value
Timestamp	Record timestamp	2023-10-15 14:30:25
Type	Record type	example
Status	Record status	active
UserID	User identifier	user123
Metadata	Additional metadata	{}

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.