Transparency, Consent, and Control (TCC)

Overview

Evidence: Transparency, Consent, and Control (TCC) Description: Collect Transparency, Consent, and Control Information Category: System Platform: macos Short Name: tcc Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

TCC is macOS's privacy framework managing application permissions to sensitive resources (camera, microphone, files, etc.). This data is essential for auditing privacy decisions and detecting over‑permissive apps.

Data Collected

This collector gathers structured data about transparency, consent, and control (tcc).

Transparency, Consent, and Control (TCC) Data

Field	Description	Example
User	User	Example value
Service	Service	Example value
Client	Client	Example value
AuthReason	Auth Reason	Example value
AuthValue	Auth Value	Example value
LastModified	Last Modified	2023-10-15 14:30:25+03:00

Collection Method

This collector copies TCC databases from system and user paths and parses the access table to extract service, client, reason, and value.

Forensic Value

This evidence is crucial for forensic investigations as it reveals which apps were granted or denied sensitive permissions and when, assisting in identifying privacy abuses.