MacOS System Artefacts

Frequently asked questions

Can you tell whether someone actually opened a file, not just that it was there?

Yes, that is exactly what system artefacts are for (§4, Example 1). Recent-items lists, quick-look thumbnails, file- system events and unified-log entries together can show that a specific file was opened or previewed, and when. This activity evidence is often far more telling than the mere existence of the file, especially in confidential it y and employment disputes where the issue is use, not just possession. The artefacts distinguish a file that sat unopened from one that was actively used.

What is Knowledge C and why is it useful?

It is one of the macOS activity databases (§3, §4), a record of user and device activity, including application usage and when the device was awake and in use, over time. It is useful because it gives a clear, timestamped picture of when the machine and its applications were actually used, helping reconstruct user behaviour and presence at the device. Read alongside the unified logs and other artefacts, it is a valuable part of the activity timeline, interpreted, like all artefacts, for what it specifically shows.

There are no log entries for the period we care about. Does that clear our opponent?

Not necessarily, this is the log-rotation trap (§6, Example 2). The unified logs retain only a limited window, and older entries are aged out to save space, so an absence of entries for an earlier period may simply mean the logs have rotated, not that nothing happened. A gap is not proof of inactivity. An honest analysis says so, preserves promptly to save what remains, and looks to earlier Time Machine backups, which often preserve artefacts since rotated off the live machine.

Can the artefacts show what someone searched for?

Often yes (§4, Example 3). Spotlight and related artefacts can evidence what was searched for on the machine, which can reveal interest, intent and preparation that the content of files does not convey (guide 125). Combined with application-use records, this can be powerful behavioural evidence. It is interpreted carefully, a search shows interest and activity, attributed to an account with care, not a completed act, but what a person sought on a machine frequently illuminates why they were doing what they did.

How urgent is preserving the Mac for this kind of evidence?

Genuinely urgent (§6, Example 2). Because the unified logs and some artefacts rotate, ageing out older entries as the machine keeps running, every day of continued use can erode the record of the period in issue. Preserving the Mac promptly, and acquiring it quickly, maximises how far back the activity record reaches. As with Mac acquisition generally (guide 131), the sooner the machine is secured and examined, the more of its detailed activity history survives to be analysed.

Do the artefacts prove who was using the machine?

They show account activity; attributing it to a person takes care (§6, guide 105). The artefacts record what was done under a user account, but a machine may be shared, and an account is not automatically an individual. So activity is attributed to the account first, and to a person only with corroboration, other artefacts, the estate, surrounding evidence, and stated at honest confidence. This keeps the powerful activity record from being overstretched into an unsupported claim about exactly who was at the keyboard. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17