Shared File List

Overview

Evidence: Shared File List Description: Collect Shared File List (SFL) items Category: System Platform: macos Short Name: sfl Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Shared File List (SFL/SFL2) stores recent items and application-specific lists. This data is essential for reconstructing user activity and identifying recently accessed files and apps.

Data Collected

This collector gathers structured data about shared file list.

Shared File List Data

Field	Description	Example
User	User	Example value
SourceFile	Source File	Example value
SourceName	Source Name	Example value
ItemIndex	Item Index	123
Name	Name	Example value
URL	URL	Example value

Collection Method

This collector copies user SFL/SFL2 files, decodes NSKeyedArchive contents, and records entries into shared_file_list.

Forensic Value

This evidence is crucial for forensic investigations as it reveals recent documents and locations, aiding timeline building and data exfiltration analysis.