Skip to content
Binalyze Knowledge Base

macOS Collections

macOS Evidence List

Section titled “macOS Evidence List”
# Evidence
(click for details)		 Category Parsed Sent to the
Investigation Hub		 Raw Files
Collected
1 .DS_Store Files DiskFilesystem Yes Yes No
2 .Trash DiskFilesystem Yes Yes No
3 AI Agent Events AI Yes Yes No
4 AI Agents AI Yes Yes No
5 AI Artifacts AI No Yes Yes
6 AI Commands AI Yes Yes No
7 AI Configs AI Yes Yes No
8 AI Hooks AI Yes Yes No
9 AI MCP AI Yes Yes No
10 AI Models AI Yes Yes No
11 AI Rules AI Yes Yes No
12 AI Secrets AI Yes Yes No
13 AI Sessions AI Yes Yes No
14 AI Skills AI Yes Yes No
15 AnyDesk Logs Applications No No Yes
16 Apache Logs Applications No No Yes
17 Apple Audit Logs System Yes Yes No
18 Apple System Logs (ASL) System Yes Yes No
19 Application In Focus System Yes Yes No
20 Application Intents System Yes Yes No
21 Application Media Usage System Yes Yes No
22 Application Usage System Yes Yes No
23 Application Web Usage System Yes Yes No
24 Arc Bookmarks Applications Yes Yes No
25 Arc Browsing History Applications Yes Yes No
26 Arc Cookies Applications Yes Yes No
27 Arc Downloads Applications Yes Yes No
28 Arc Favicons Applications Yes Yes No
29 Arc Form History Applications Yes Yes No
30 Arc Local Storage Applications Yes Yes No
31 Arc Login Data Applications Yes Yes No
32 Arc Sessions Applications Yes Yes No
33 Arc Thumbnails Applications Yes Yes No
34 Arc User Profiles Applications Yes Yes No
35 Arc Web Storage Applications Yes Yes No
36 Audio Output Route System Yes Yes No
37 Auto Loaded Processes System Yes Yes No
38 Block Devices DiskFilesystem Yes Yes No
39 Bluetooth Connections System Yes Yes No
40 Brave Bookmarks Applications Yes Yes No
41 Brave Browsing History Applications Yes Yes No
42 Brave Cookies Applications Yes Yes No
43 Brave Downloads Applications Yes Yes No
44 Brave Favicons Applications Yes Yes No
45 Brave Form History Applications Yes Yes No
46 Brave Local Storage Applications Yes Yes No
47 Brave Login Data Applications Yes Yes No
48 Brave Sessions Applications Yes Yes No
49 Brave Thumbnails Applications Yes Yes No
50 Brave User Profiles Applications Yes Yes No
51 Brave Web Storage Applications Yes Yes No
52 Chrome Bookmarks Applications Yes Yes No
53 Chrome Browsing History Applications Yes Yes No
54 Chrome Cookies Applications Yes Yes No
55 Chrome Downloads Applications Yes Yes No
56 Chrome Extensions Applications Yes Yes No
57 Chrome Favicons Applications Yes Yes No
58 Chrome Form History Applications Yes Yes No
59 Chrome Local Storage Applications Yes Yes No
60 Chrome Login Data Applications Yes Yes No
61 Chrome Sessions Applications Yes Yes No
62 Chrome Thumbnails Applications Yes Yes No
63 Chrome User Profiles Applications Yes Yes No
64 Chrome Web Storage Applications Yes Yes No
65 Collect File System (FS) Events DiskFilesystem Yes Yes No
66 Command Line Activity EventLogs Yes Yes No
67 Crashes System Yes Yes No
68 Cron Jobs System Yes Yes No
69 DHCP Settings Network Yes Yes No
70 DMG File Opened DiskFilesystem Yes Yes No
71 DNS Resolvers Network Yes Yes No
72 Default Browser Applications Yes Yes No
73 Dependency Manifests Applications Yes Yes No
74 Device Battery Percentage System Yes Yes No
75 Device Locked State System Yes Yes No
76 Device Plugged In State System Yes Yes No
77 Discord Desktop Cache Applications No No Yes
78 Disk Encryption DiskFilesystem Yes Yes No
79 Dock Items System Yes Yes No
80 Docker Changes Applications Yes Yes No
81 Docker Container Logs Applications Yes Yes No
82 Docker Containers Applications Yes Yes No
83 Docker Image History Applications Yes Yes No
84 Docker Images Applications Yes Yes No
85 Docker Info Applications Yes Yes No
86 Docker Logs Applications No No Yes
87 Docker Networks Applications Yes Yes No
88 Docker Processes Applications Yes Yes No
89 Docker Volumes Applications Yes Yes No
90 Document Revisions System Yes Yes No
91 Downloaded Files Information System Yes Yes No
92 Dump Arc Indexed DB Applications Yes Yes No
93 Dump Brave Indexed DB Applications Yes Yes No
94 Dump Chrome Indexed DB Applications Yes Yes No
95 Dump Edge Indexed DB Applications Yes Yes No
96 Dump Opera Indexed DB Applications Yes Yes No
97 Dump QQ Indexed DB Applications Yes Yes No
98 Dump Vivaldi Indexed DB Applications Yes Yes No
99 ETC Files System No Yes Yes
100 ETC Hosts Network Yes Yes No
101 ETC Protocols Network Yes Yes No
102 ETC Services Network Yes Yes No
103 Edge Bookmarks Applications Yes Yes No
104 Edge Browsing History Applications Yes Yes No
105 Edge Cookies Applications Yes Yes No
106 Edge Downloads Applications Yes Yes No
107 Edge Extensions Applications Yes Yes No
108 Edge Favicons Applications Yes Yes No
109 Edge Form History Applications Yes Yes No
110 Edge Local Storage Applications Yes Yes No
111 Edge Login Data Applications Yes Yes No
112 Edge Sessions Applications Yes Yes No
113 Edge Thumbnails Applications Yes Yes No
114 Edge User Profiles Applications Yes Yes No
115 Edge Web Storage Applications Yes Yes No
116 Emond Clients System Yes Yes No
117 Event Taps System Yes Yes No
118 Extended Attributes System Yes Yes No
119 Failed Sudo EventLogs Yes Yes No
120 File Last Used DiskFilesystem Yes Yes No
121 File System Enumeration DiskFilesystem Yes No No
122 Finder Mounted Volume DiskFilesystem Yes Yes No
123 Firefox Browsing History Applications Yes Yes No
124 Firefox Cookies Applications Yes Yes No
125 Firefox Downloads Applications Yes Yes No
126 Firefox Extensions Applications Yes Yes No
127 Gatekeeper System Yes Yes No
128 Gatekeeper Approved Apps System Yes Yes No
129 Homebrew Logs Applications No No Yes
130 IP Routes Network Yes Yes No
131 IDE Extensions Applications Yes Yes No
132 Install Logs System No No Yes
133 Installed Applications System Yes Yes No
134 Kernel Extensions EventLogs Yes Yes No
135 Kernel Extensions Info System Yes Yes No
136 Keyboard Dictionary System Yes Yes No
137 Keychain EventLogs Yes Yes No
138 KnowledgeC System No No Yes
139 Launchd Files System No Yes Yes
140 Launchd Overrides System Yes Yes No
141 Listening Ports Network Yes Yes No
142 Logged Users System Yes Yes No
143 Login Hooks System Yes Yes No
144 Login Items System Yes Yes No
145 Logind EventLogs Yes Yes No
146 Logout Hooks System Yes Yes No
147 Mail Rules System Yes Yes No
148 Media Now Playing System Yes Yes No
149 Manuel Configuration Profile Install EventLogs Yes Yes No
150 MongoDB Logs Applications No No Yes
151 Most Recently Used (MRU) System Yes Yes No
152 Mount DiskFilesystem Yes Yes No
153 MySQL Logs Applications No No Yes
154 NGINX Logs Applications No No Yes
155 Network Interfaces Network Yes Yes No
156 Network Usage Network Yes Yes No
157 NetworkFlow System No Yes No
158 Notification Info System Yes Yes No
159 Opera Bookmarks Applications Yes Yes No
160 Opera Browsing History Applications Yes Yes No
161 Opera Cookies Applications Yes Yes No
162 Opera Downloads Applications Yes Yes No
163 Opera Extensions Applications Yes Yes No
164 Opera Favicons Applications Yes Yes No
165 Opera Form History Applications Yes Yes No
166 Opera Local Storage Applications Yes Yes No
167 Opera Login Data Applications Yes Yes No
168 Opera Sessions Applications Yes Yes No
169 Opera Thumbnails Applications Yes Yes No
170 Opera User Profiles Applications Yes Yes No
171 Opera Web Storage Applications Yes Yes No
172 PCAP System No Yes No
173 Package Install History System Yes Yes No
174 Parallels Logs Applications No No Yes
175 Parse File System (FS) Events DiskFilesystem Yes Yes No
176 PostgreSQL Logs Applications No No Yes
177 Print Jobs System Yes Yes No
178 Printer Info System Yes Yes No
179 Processes System Yes Yes No
180 QQ Bookmarks Applications Yes Yes No
181 QQ Browsing History Applications Yes Yes No
182 QQ Cookies Applications Yes Yes No
183 QQ Downloads Applications Yes Yes No
184 QQ Favicons Applications Yes Yes No
185 QQ Form History Applications Yes Yes No
186 QQ Local Storage Applications Yes Yes No
187 QQ Login Data Applications Yes Yes No
188 QQ Sessions Applications Yes Yes No
189 QQ Thumbnails Applications Yes Yes No
190 QQ User Profiles Applications Yes Yes No
191 QQ Web Storage Applications Yes Yes No
192 Quarantine Events System Yes Yes No
193 Quick Look Cache System Yes Yes No
194 Re-Opened Apps System Yes Yes No
195 SSH Authorized Keys Network Yes Yes No
196 SSH Configs Network Yes Yes No
197 SSH Files System No Yes Yes
198 SSH Known Hosts Network Yes Yes No
199 SSHD Configs Network Yes Yes No
200 Safari Browsing History Applications Yes Yes No
201 Safari Downloads Applications Yes Yes No
202 Screensharing EventLogs Yes Yes No
203 Session Creation and Destruction EventLogs Yes Yes No
204 Shared File List System Yes Yes No
205 Shell History System Yes Yes No
206 Software Update Information System Yes Yes No
207 Sophos Events Database Applications No No Yes
208 Sophos Logs Applications No No Yes
209 Splashtop Mac Logs Applications No No Yes
210 Spotlight System Yes Yes Yes
211 Sshd EventLogs Yes Yes No
212 Sudo Last Run System Yes Yes No
213 System Extension Info System Yes Yes No
214 System Integrity Protection Status System Yes Yes No
215 System Logs System No No Yes
216 Tccd EventLogs Yes Yes No
217 Teamviewer Logs Applications No No Yes
218 Transparency, Consent, and Control (TCC) System Yes Yes No
219 USB Info System Yes Yes No
220 User Groups System Yes Yes No
221 Users System Yes Yes No
222 Vivaldi Bookmarks Applications Yes Yes No
223 Vivaldi Browsing History Applications Yes Yes No
224 Vivaldi Cookies Applications Yes Yes No
225 Vivaldi Downloads Applications Yes Yes No
226 Vivaldi Favicons Applications Yes Yes No
227 Vivaldi Form History Applications Yes Yes No
228 Vivaldi Local Storage Applications Yes Yes No
229 Vivaldi Login Data Applications Yes Yes No
230 Vivaldi Sessions Applications Yes Yes No
231 Vivaldi Thumbnails Applications Yes Yes No
232 Vivaldi User Profiles Applications Yes Yes No
233 Vivaldi Web Storage Applications Yes Yes No
234 Waterfox Browsing History Applications Yes Yes No
235 Waterfox Downloads Applications Yes Yes No
236 Wifi Logs Network No No Yes
237 Wireless Network Connections Network Yes Yes No
238 XProtect Remediation EventLogs Yes Yes No
239 iMessage System Yes Yes Yes