Transparency, Consent, and Control (TCC)
Overview
Section titled “Overview”Evidence: Transparency, Consent, and Control (TCC)
Description: Collect Transparency, Consent, and Control Information
Category: System
Platform: macos
Short Name: tcc
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”TCC is macOS’s privacy framework managing application permissions to sensitive resources (camera, microphone, files, etc.). This data is essential for auditing privacy decisions and detecting over‑permissive apps.
Data Collected
Section titled “Data Collected”This collector gathers structured data about transparency, consent, and control (tcc).
Transparency, Consent, and Control (TCC) Data
Section titled “Transparency, Consent, and Control (TCC) Data”| Field | Description | Example |
|---|---|---|
User | User | Example value |
Service | Service | Example value |
Client | Client | Example value |
AuthReason | Auth Reason | Example value |
AuthValue | Auth Value | Example value |
LastModified | Last Modified | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”This collector copies TCC databases from system and user paths and parses the access table to extract service, client, reason, and value.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals which apps were granted or denied sensitive permissions and when, assisting in identifying privacy abuses.