Skip to content
Binalyze Knowledge Base

macOS Collections

macOS Evidence List

Section titled “macOS Evidence List”
# Evidence
(click for details)		 Category Parsed Sent to the
Investigation Hub		 Raw Files
Collected
1 .DS_Store Files DiskFilesystem Yes Yes No
2 .Trash DiskFilesystem Yes Yes No
3 AI Agent Events AI Yes Yes No
4 AI Agents AI Yes Yes No
5 AI Artifacts AI No Yes Yes
6 AI Commands AI Yes Yes No
7 AI Configs AI Yes Yes No
8 AI Hooks AI Yes Yes No
9 AI MCP AI Yes Yes No
10 AI Models AI Yes Yes No
11 AI Rules AI Yes Yes No
12 AI Secrets AI Yes Yes No
13 AI Sessions AI Yes Yes No
14 AI Skills AI Yes Yes No
15 AnyDesk Logs Applications No No Yes
16 Apache Logs Applications No No Yes
17 Apple Audit Logs System Yes Yes No
18 Apple System Logs (ASL) System Yes Yes No
19 Application In Focus System Yes Yes No
20 Application Intents System Yes Yes No
21 Application Media Usage System Yes Yes No
22 Application Usage System Yes Yes No
23 Application Web Usage System Yes Yes No
24 Arc Bookmarks Applications Yes Yes No
25 Arc Browsing History Applications Yes Yes No
26 Arc Cookies Applications Yes Yes No
27 Arc Downloads Applications Yes Yes No
28 Arc Favicons Applications Yes Yes Yes
29 Arc Form History Applications Yes Yes No
30 Arc Local Storage Applications Yes Yes No
31 Arc Login Data Applications Yes Yes No
32 Arc Omnibox Shortcuts Applications Yes Yes Yes
33 Arc Sessions Applications Yes Yes No
34 Arc Thumbnails Applications Yes Yes No
35 Arc User Profiles Applications Yes Yes No
36 Arc Web Storage Applications Yes Yes No
37 Audio Output Route System Yes Yes No
38 Auto Loaded Processes System Yes Yes No
39 Block Devices DiskFilesystem Yes Yes No
40 Bluetooth Connections System Yes Yes No
41 Brave Bookmarks Applications Yes Yes No
42 Brave Browsing History Applications Yes Yes No
43 Brave Cookies Applications Yes Yes No
44 Brave Downloads Applications Yes Yes No
45 Brave Favicons Applications Yes Yes Yes
46 Brave Form History Applications Yes Yes No
47 Brave Local Storage Applications Yes Yes No
48 Brave Login Data Applications Yes Yes No
49 Brave Omnibox Shortcuts Applications Yes Yes Yes
50 Brave Sessions Applications Yes Yes No
51 Brave Thumbnails Applications Yes Yes No
52 Brave User Profiles Applications Yes Yes No
53 Brave Web Storage Applications Yes Yes No
54 Chrome Bookmarks Applications Yes Yes No
55 Chrome Browsing History Applications Yes Yes No
56 Chrome Cookies Applications Yes Yes No
57 Chrome Downloads Applications Yes Yes No
58 Chrome Extensions Applications Yes Yes No
59 Chrome Favicons Applications Yes Yes Yes
60 Chrome Form History Applications Yes Yes No
61 Chrome Local Storage Applications Yes Yes No
62 Chrome Login Data Applications Yes Yes No
63 Chrome Omnibox Shortcuts Applications Yes Yes Yes
64 Chrome Sessions Applications Yes Yes No
65 Chrome Thumbnails Applications Yes Yes No
66 Chrome User Profiles Applications Yes Yes No
67 Chrome Web Storage Applications Yes Yes No
68 Collect File System (FS) Events DiskFilesystem Yes Yes No
69 Command Line Activity EventLogs Yes Yes No
70 Crashes System Yes Yes No
71 Cron Jobs System Yes Yes No
72 DHCP Settings Network Yes Yes No
73 DMG File Opened DiskFilesystem Yes Yes No
74 DNS Resolvers Network Yes Yes No
75 Default Browser Applications Yes Yes No
76 Dependency Manifests Applications Yes Yes No
77 Device Battery Percentage System Yes Yes No
78 Device Locked State System Yes Yes No
79 Device Plugged In State System Yes Yes No
80 Discord Desktop Cache Applications No No Yes
81 Disk Encryption DiskFilesystem Yes Yes No
82 Dock Items System Yes Yes No
83 Docker Changes Applications Yes Yes No
84 Docker Container Logs Applications Yes Yes No
85 Docker Containers Applications Yes Yes No
86 Docker Image History Applications Yes Yes No
87 Docker Images Applications Yes Yes No
88 Docker Info Applications Yes Yes No
89 Docker Logs Applications No No Yes
90 Docker Networks Applications Yes Yes No
91 Docker Processes Applications Yes Yes No
92 Docker Volumes Applications Yes Yes No
93 Document Revisions System Yes Yes No
94 Downloaded Files Information System Yes Yes No
95 Dump Arc Indexed DB Applications Yes Yes No
96 Dump Arc Preferences Applications No No Yes
97 Dump Brave Indexed DB Applications Yes Yes No
98 Dump Brave Preferences Applications No No Yes
99 Dump Chrome Indexed DB Applications Yes Yes No
100 Dump Chrome Preferences Applications No No Yes
101 Dump Edge Indexed DB Applications Yes Yes No
102 Dump Edge Preferences Applications No No Yes
103 Dump Firefox Preferences Applications No No Yes
104 Dump Opera Indexed DB Applications Yes Yes No
105 Dump Opera Preferences Applications No No Yes
106 Dump QQ Indexed DB Applications Yes Yes No
107 Dump QQ Preferences Applications No No Yes
108 Dump Safari Preferences Applications No No Yes
109 Dump Vivaldi Indexed DB Applications Yes Yes No
110 Dump Vivaldi Preferences Applications No No Yes
111 ETC Files System No Yes Yes
112 ETC Hosts Network Yes Yes No
113 ETC Protocols Network Yes Yes No
114 ETC Services Network Yes Yes No
115 Edge Bookmarks Applications Yes Yes No
116 Edge Browsing History Applications Yes Yes No
117 Edge Cookies Applications Yes Yes No
118 Edge Downloads Applications Yes Yes No
119 Edge Extensions Applications Yes Yes No
120 Edge Favicons Applications Yes Yes Yes
121 Edge Form History Applications Yes Yes No
122 Edge Local Storage Applications Yes Yes No
123 Edge Login Data Applications Yes Yes No
124 Edge Omnibox Shortcuts Applications Yes Yes Yes
125 Edge Sessions Applications Yes Yes No
126 Edge Thumbnails Applications Yes Yes No
127 Edge User Profiles Applications Yes Yes No
128 Edge Web Storage Applications Yes Yes No
129 Emond Clients System Yes Yes No
130 Event Taps System Yes Yes No
131 Extended Attributes System Yes Yes No
132 Failed Sudo EventLogs Yes Yes No
133 File Last Used DiskFilesystem Yes Yes No
134 File System Enumeration DiskFilesystem Yes No No
135 Finder Mounted Volume DiskFilesystem Yes Yes No
136 Firefox Bookmarks Applications Yes Yes No
137 Firefox Browsing History Applications Yes Yes No
138 Firefox Cookies Applications Yes Yes No
139 Firefox Downloads Applications Yes Yes No
140 Firefox Extensions Applications Yes Yes No
141 Firefox Favicons Applications Yes Yes Yes
142 Gatekeeper System Yes Yes No
143 Gatekeeper Approved Apps System Yes Yes No
144 Homebrew Logs Applications No No Yes
145 IP Routes Network Yes Yes No
146 IDE Extensions Applications Yes Yes No
147 Install Logs System No No Yes
148 Installed Applications System Yes Yes No
149 Kernel Extensions EventLogs Yes Yes No
150 Kernel Extensions Info System Yes Yes No
151 Keyboard Dictionary System Yes Yes No
152 Keychain EventLogs Yes Yes No
153 KnowledgeC System No No Yes
154 Launchd Files System No Yes Yes
155 Launchd Overrides System Yes Yes No
156 Listening Ports Network Yes Yes No
157 Logged Users System Yes Yes No
158 Login Hooks System Yes Yes No
159 Login Items System Yes Yes No
160 Logind EventLogs Yes Yes No
161 Logout Hooks System Yes Yes No
162 Mail Rules System Yes Yes No
163 Media Now Playing System Yes Yes No
164 Manuel Configuration Profile Install EventLogs Yes Yes No
165 MongoDB Logs Applications No No Yes
166 Most Recently Used (MRU) System Yes Yes No
167 Mount DiskFilesystem Yes Yes No
168 MySQL Logs Applications No No Yes
169 NGINX Logs Applications No No Yes
170 Network Interfaces Network Yes Yes No
171 Network Usage Network Yes Yes No
172 NetworkFlow System No Yes No
173 Notification Info System Yes Yes No
174 Opera Bookmarks Applications Yes Yes No
175 Opera Browsing History Applications Yes Yes No
176 Opera Cookies Applications Yes Yes No
177 Opera Downloads Applications Yes Yes No
178 Opera Extensions Applications Yes Yes No
179 Opera Favicons Applications Yes Yes Yes
180 Opera Form History Applications Yes Yes No
181 Opera Local Storage Applications Yes Yes No
182 Opera Login Data Applications Yes Yes No
183 Opera Omnibox Shortcuts Applications Yes Yes Yes
184 Opera Sessions Applications Yes Yes No
185 Opera Thumbnails Applications Yes Yes No
186 Opera User Profiles Applications Yes Yes No
187 Opera Web Storage Applications Yes Yes No
188 PCAP System No Yes No
189 Package Install History System Yes Yes No
190 Parallels Logs Applications No No Yes
191 Parse File System (FS) Events DiskFilesystem Yes Yes No
192 PostgreSQL Logs Applications No No Yes
193 Print Jobs System Yes Yes No
194 Printer Info System Yes Yes No
195 Processes System Yes Yes No
196 QQ Bookmarks Applications Yes Yes No
197 QQ Browsing History Applications Yes Yes No
198 QQ Cookies Applications Yes Yes No
199 QQ Downloads Applications Yes Yes No
200 QQ Favicons Applications Yes Yes Yes
201 QQ Form History Applications Yes Yes No
202 QQ Local Storage Applications Yes Yes No
203 QQ Login Data Applications Yes Yes No
204 QQ Omnibox Shortcuts Applications Yes Yes Yes
205 QQ Sessions Applications Yes Yes No
206 QQ Thumbnails Applications Yes Yes No
207 QQ User Profiles Applications Yes Yes No
208 QQ Web Storage Applications Yes Yes No
209 Quarantine Events System Yes Yes No
210 Quick Look Cache System Yes Yes No
211 Re-Opened Apps System Yes Yes No
212 SSH Authorized Keys Network Yes Yes No
213 SSH Configs Network Yes Yes No
214 SSH Files System No Yes Yes
215 SSH Known Hosts Network Yes Yes No
216 SSHD Configs Network Yes Yes No
217 Safari Bookmarks Applications Yes Yes No
218 Safari Browsing History Applications Yes Yes No
219 Safari Downloads Applications Yes Yes No
220 Safari Favicons Applications Yes Yes Yes
221 Screensharing EventLogs Yes Yes No
222 Session Creation and Destruction EventLogs Yes Yes No
223 Shared File List System Yes Yes No
224 Shell History System Yes Yes No
225 Software Update Information System Yes Yes No
226 Sophos Events Database Applications No No Yes
227 Sophos Logs Applications No No Yes
228 Splashtop Mac Logs Applications No No Yes
229 Spotlight System Yes Yes Yes
230 Sshd EventLogs Yes Yes No
231 Sudo Last Run System Yes Yes No
232 System Extension Info System Yes Yes No
233 System Integrity Protection Status System Yes Yes No
234 System Logs System No No Yes
235 Tccd EventLogs Yes Yes No
236 Teamviewer Logs Applications No No Yes
237 Transparency, Consent, and Control (TCC) System Yes Yes No
238 USB Info System Yes Yes No
239 User Groups System Yes Yes No
240 Users System Yes Yes No
241 Vivaldi Bookmarks Applications Yes Yes No
242 Vivaldi Browsing History Applications Yes Yes No
243 Vivaldi Cookies Applications Yes Yes No
244 Vivaldi Downloads Applications Yes Yes No
245 Vivaldi Favicons Applications Yes Yes Yes
246 Vivaldi Form History Applications Yes Yes No
247 Vivaldi Local Storage Applications Yes Yes No
248 Vivaldi Login Data Applications Yes Yes No
249 Vivaldi Omnibox Shortcuts Applications Yes Yes Yes
250 Vivaldi Sessions Applications Yes Yes No
251 Vivaldi Thumbnails Applications Yes Yes No
252 Vivaldi User Profiles Applications Yes Yes No
253 Vivaldi Web Storage Applications Yes Yes No
254 Waterfox Browsing History Applications Yes Yes No
255 Waterfox Downloads Applications Yes Yes No
256 Wifi Logs Network No No Yes
257 Wireless Network Connections Network Yes Yes No
258 XProtect Remediation EventLogs Yes Yes No
259 iMessage System Yes Yes Yes