Evidence: Teamviewer Logs
Description: Collect Teamviewer Logs
Category: Applications
Platform: macos
Short Name: tvwl
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
TeamViewer is a popular remote access and support tool that maintains detailed logs of connections, network activities, and session information. It stores separate logs for general activities and network-specific events.
Data Collected
This collector gathers structured data about teamviewer logs.
Collection Method
This collector gathers TeamViewer log files from user Library directories, including both the main logfile and network-specific logfile that track all remote access sessions and connections.
Forensic Value
TeamViewer logs are essential for investigating unauthorized remote access, social engineering attacks, data theft, and ransomware deployment. They provide connection IDs, partner IDs, session times, and activities that are frequently involved in security incidents.
