Skip to content
Binalyze Knowledge Base

macOS Collections

macOS Evidence List

Section titled “macOS Evidence List”
# Evidence
(click for details)		 Category Parsed Sent to the
Investigation Hub		 Raw Files
Collected
1 .DS_Store Files DiskFilesystem Yes Yes No
2 .Trash DiskFilesystem Yes Yes No
3 AI Agent Events AI Yes Yes No
4 AI Agents AI Yes Yes No
5 AI Artifacts AI No Yes Yes
6 AI Commands AI Yes Yes No
7 AI Configs AI Yes Yes No
8 AI Hooks AI Yes Yes No
9 AI MCP AI Yes Yes No
10 AI Models AI Yes Yes No
11 AI Rules AI Yes Yes No
12 AI Secrets AI Yes Yes No
13 AI Sessions AI Yes Yes No
14 AI Skills AI Yes Yes No
15 AnyDesk Logs Applications No No Yes
16 Apache Logs Applications No No Yes
17 Apple Audit Logs System Yes Yes No
18 Apple System Logs (ASL) System Yes Yes No
19 Application In Focus System Yes Yes No
20 Application Intents System Yes Yes No
21 Application Media Usage System Yes Yes No
22 Application Usage System Yes Yes No
23 Application Web Usage System Yes Yes No
24 Arc Bookmarks Applications Yes Yes No
25 Arc Browsing History Applications Yes Yes No
26 Arc Cookies Applications Yes Yes No
27 Arc Downloads Applications Yes Yes No
28 Arc Favicons Applications Yes Yes No
29 Arc Form History Applications Yes Yes No
30 Arc Local Storage Applications Yes Yes No
31 Arc Login Data Applications Yes Yes No
32 Arc Sessions Applications Yes Yes No
33 Arc Thumbnails Applications Yes Yes No
34 Arc User Profiles Applications Yes Yes No
35 Arc Web Storage Applications Yes Yes No
36 Audio Output Route System Yes Yes No
37 Auto Loaded Processes System Yes Yes No
38 Block Devices DiskFilesystem Yes Yes No
39 Bluetooth Connections System Yes Yes No
40 Brave Bookmarks Applications Yes Yes No
41 Brave Browsing History Applications Yes Yes No
42 Brave Cookies Applications Yes Yes No
43 Brave Downloads Applications Yes Yes No
44 Brave Favicons Applications Yes Yes No
45 Brave Form History Applications Yes Yes No
46 Brave Local Storage Applications Yes Yes No
47 Brave Login Data Applications Yes Yes No
48 Brave Sessions Applications Yes Yes No
49 Brave Thumbnails Applications Yes Yes No
50 Brave User Profiles Applications Yes Yes No
51 Brave Web Storage Applications Yes Yes No
52 Chrome Bookmarks Applications Yes Yes No
53 Chrome Browsing History Applications Yes Yes No
54 Chrome Cookies Applications Yes Yes No
55 Chrome Downloads Applications Yes Yes No
56 Chrome Extensions Applications Yes Yes No
57 Chrome Favicons Applications Yes Yes No
58 Chrome Form History Applications Yes Yes No
59 Chrome Local Storage Applications Yes Yes No
60 Chrome Login Data Applications Yes Yes No
61 Chrome Sessions Applications Yes Yes No
62 Chrome Thumbnails Applications Yes Yes No
63 Chrome User Profiles Applications Yes Yes No
64 Chrome Web Storage Applications Yes Yes No
65 Collect File System (FS) Events DiskFilesystem Yes Yes No
66 Command Line Activity EventLogs Yes Yes No
67 Crashes System Yes Yes No
68 Cron Jobs System Yes Yes No
69 DHCP Settings Network Yes Yes No
70 DMG File Opened DiskFilesystem Yes Yes No
71 DNS Resolvers Network Yes Yes No
72 Default Browser Applications Yes Yes No
73 Dependency Manifests Applications Yes Yes No
74 Device Battery Percentage System Yes Yes No
75 Device Locked State System Yes Yes No
76 Device Plugged In State System Yes Yes No
77 Discord Desktop Cache Applications No No Yes
78 Disk Encryption DiskFilesystem Yes Yes No
79 Dock Items System Yes Yes No
80 Docker Changes Applications Yes Yes No
81 Docker Container Logs Applications Yes Yes No
82 Docker Containers Applications Yes Yes No
83 Docker Image History Applications Yes Yes No
84 Docker Images Applications Yes Yes No
85 Docker Info Applications Yes Yes No
86 Docker Logs Applications No No Yes
87 Docker Networks Applications Yes Yes No
88 Docker Processes Applications Yes Yes No
89 Docker Volumes Applications Yes Yes No
90 Document Revisions System Yes Yes No
91 Downloaded Files Information System Yes Yes No
92 Dump Arc Indexed DB Applications Yes Yes No
93 Dump Arc Preferences Applications No No Yes
94 Dump Brave Indexed DB Applications Yes Yes No
95 Dump Brave Preferences Applications No No Yes
96 Dump Chrome Indexed DB Applications Yes Yes No
97 Dump Chrome Preferences Applications No No Yes
98 Dump Edge Indexed DB Applications Yes Yes No
99 Dump Edge Preferences Applications No No Yes
100 Dump Firefox Preferences Applications No No Yes
101 Dump Opera Indexed DB Applications Yes Yes No
102 Dump Opera Preferences Applications No No Yes
103 Dump QQ Indexed DB Applications Yes Yes No
104 Dump QQ Preferences Applications No No Yes
105 Dump Safari Preferences Applications No No Yes
106 Dump Vivaldi Indexed DB Applications Yes Yes No
107 Dump Vivaldi Preferences Applications No No Yes
108 ETC Files System No Yes Yes
109 ETC Hosts Network Yes Yes No
110 ETC Protocols Network Yes Yes No
111 ETC Services Network Yes Yes No
112 Edge Bookmarks Applications Yes Yes No
113 Edge Browsing History Applications Yes Yes No
114 Edge Cookies Applications Yes Yes No
115 Edge Downloads Applications Yes Yes No
116 Edge Extensions Applications Yes Yes No
117 Edge Favicons Applications Yes Yes No
118 Edge Form History Applications Yes Yes No
119 Edge Local Storage Applications Yes Yes No
120 Edge Login Data Applications Yes Yes No
121 Edge Sessions Applications Yes Yes No
122 Edge Thumbnails Applications Yes Yes No
123 Edge User Profiles Applications Yes Yes No
124 Edge Web Storage Applications Yes Yes No
125 Emond Clients System Yes Yes No
126 Event Taps System Yes Yes No
127 Extended Attributes System Yes Yes No
128 Failed Sudo EventLogs Yes Yes No
129 File Last Used DiskFilesystem Yes Yes No
130 File System Enumeration DiskFilesystem Yes No No
131 Finder Mounted Volume DiskFilesystem Yes Yes No
132 Firefox Browsing History Applications Yes Yes No
133 Firefox Cookies Applications Yes Yes No
134 Firefox Downloads Applications Yes Yes No
135 Firefox Extensions Applications Yes Yes No
136 Gatekeeper System Yes Yes No
137 Gatekeeper Approved Apps System Yes Yes No
138 Homebrew Logs Applications No No Yes
139 IP Routes Network Yes Yes No
140 IDE Extensions Applications Yes Yes No
141 Install Logs System No No Yes
142 Installed Applications System Yes Yes No
143 Kernel Extensions EventLogs Yes Yes No
144 Kernel Extensions Info System Yes Yes No
145 Keyboard Dictionary System Yes Yes No
146 Keychain EventLogs Yes Yes No
147 KnowledgeC System No No Yes
148 Launchd Files System No Yes Yes
149 Launchd Overrides System Yes Yes No
150 Listening Ports Network Yes Yes No
151 Logged Users System Yes Yes No
152 Login Hooks System Yes Yes No
153 Login Items System Yes Yes No
154 Logind EventLogs Yes Yes No
155 Logout Hooks System Yes Yes No
156 Mail Rules System Yes Yes No
157 Media Now Playing System Yes Yes No
158 Manuel Configuration Profile Install EventLogs Yes Yes No
159 MongoDB Logs Applications No No Yes
160 Most Recently Used (MRU) System Yes Yes No
161 Mount DiskFilesystem Yes Yes No
162 MySQL Logs Applications No No Yes
163 NGINX Logs Applications No No Yes
164 Network Interfaces Network Yes Yes No
165 Network Usage Network Yes Yes No
166 NetworkFlow System No Yes No
167 Notification Info System Yes Yes No
168 Opera Bookmarks Applications Yes Yes No
169 Opera Browsing History Applications Yes Yes No
170 Opera Cookies Applications Yes Yes No
171 Opera Downloads Applications Yes Yes No
172 Opera Extensions Applications Yes Yes No
173 Opera Favicons Applications Yes Yes No
174 Opera Form History Applications Yes Yes No
175 Opera Local Storage Applications Yes Yes No
176 Opera Login Data Applications Yes Yes No
177 Opera Sessions Applications Yes Yes No
178 Opera Thumbnails Applications Yes Yes No
179 Opera User Profiles Applications Yes Yes No
180 Opera Web Storage Applications Yes Yes No
181 PCAP System No Yes No
182 Package Install History System Yes Yes No
183 Parallels Logs Applications No No Yes
184 Parse File System (FS) Events DiskFilesystem Yes Yes No
185 PostgreSQL Logs Applications No No Yes
186 Print Jobs System Yes Yes No
187 Printer Info System Yes Yes No
188 Processes System Yes Yes No
189 QQ Bookmarks Applications Yes Yes No
190 QQ Browsing History Applications Yes Yes No
191 QQ Cookies Applications Yes Yes No
192 QQ Downloads Applications Yes Yes No
193 QQ Favicons Applications Yes Yes No
194 QQ Form History Applications Yes Yes No
195 QQ Local Storage Applications Yes Yes No
196 QQ Login Data Applications Yes Yes No
197 QQ Sessions Applications Yes Yes No
198 QQ Thumbnails Applications Yes Yes No
199 QQ User Profiles Applications Yes Yes No
200 QQ Web Storage Applications Yes Yes No
201 Quarantine Events System Yes Yes No
202 Quick Look Cache System Yes Yes No
203 Re-Opened Apps System Yes Yes No
204 SSH Authorized Keys Network Yes Yes No
205 SSH Configs Network Yes Yes No
206 SSH Files System No Yes Yes
207 SSH Known Hosts Network Yes Yes No
208 SSHD Configs Network Yes Yes No
209 Safari Browsing History Applications Yes Yes No
210 Safari Downloads Applications Yes Yes No
211 Screensharing EventLogs Yes Yes No
212 Session Creation and Destruction EventLogs Yes Yes No
213 Shared File List System Yes Yes No
214 Shell History System Yes Yes No
215 Software Update Information System Yes Yes No
216 Sophos Events Database Applications No No Yes
217 Sophos Logs Applications No No Yes
218 Splashtop Mac Logs Applications No No Yes
219 Spotlight System Yes Yes Yes
220 Sshd EventLogs Yes Yes No
221 Sudo Last Run System Yes Yes No
222 System Extension Info System Yes Yes No
223 System Integrity Protection Status System Yes Yes No
224 System Logs System No No Yes
225 Tccd EventLogs Yes Yes No
226 Teamviewer Logs Applications No No Yes
227 Transparency, Consent, and Control (TCC) System Yes Yes No
228 USB Info System Yes Yes No
229 User Groups System Yes Yes No
230 Users System Yes Yes No
231 Vivaldi Bookmarks Applications Yes Yes No
232 Vivaldi Browsing History Applications Yes Yes No
233 Vivaldi Cookies Applications Yes Yes No
234 Vivaldi Downloads Applications Yes Yes No
235 Vivaldi Favicons Applications Yes Yes No
236 Vivaldi Form History Applications Yes Yes No
237 Vivaldi Local Storage Applications Yes Yes No
238 Vivaldi Login Data Applications Yes Yes No
239 Vivaldi Sessions Applications Yes Yes No
240 Vivaldi Thumbnails Applications Yes Yes No
241 Vivaldi User Profiles Applications Yes Yes No
242 Vivaldi Web Storage Applications Yes Yes No
243 Waterfox Browsing History Applications Yes Yes No
244 Waterfox Downloads Applications Yes Yes No
245 Wifi Logs Network No No Yes
246 Wireless Network Connections Network Yes Yes No
247 XProtect Remediation EventLogs Yes Yes No
248 iMessage System Yes Yes Yes