Posts tagged: #dfir

Step by step: open a macOS .logarchive, diagnostics folder or log show export in the free Unified Log Parser, triage findings, set a time range and export.

Collect macOS Unified Logs with log collect, a raw copy of diagnostics and uuidtext, UAC, Velociraptor or mac_apt, and avoid the gaps that break parsing.

What macOS Unified Logs record, where tracev3, uuidtext and timesync live, what they can and cannot prove, and a workflow to read them for an investigation.

Inside macOS tracev3 files: header, catalog and LZ4 chunksets, firehose, oversize, statedump and simpledump chunks, uuidtext and dsc strings, and timesync.