Pro plugin

FSEvents Journal

Collects and parses macOS FSEvents filesystem event journal for file activity timeline reconstruction

filesystem.fseventsPromacOS 10.5+v1.0.0filesystemsystemactivity

Run this plugin

Trigger collection for FSEvents Journal on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin filesystem.fsevents --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin filesystem.fsevents --dry-run

Compatibility

macOS 10.5+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (5 collected, 3 planned)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

logs

Artifact	Format	Path	Notes
System Volume FSEvents system_storeRequires roothigh value	binary	`/.fseventsd/`macOS ≤ 10.14 +1 more `/System/Volumes/Data/.fseventsd/`macOS 10.15+	—
System Volume Event Files system_eventsPlanned — not collected yetRequires root	binary	`/.fseventsd/????????????????`macOS ≤ 10.14 +1 more `/System/Volumes/Data/.fseventsd/????????????????`macOS 10.15+	—
External Volume FSEvents external_storesOptionalRequires roothigh value	binary	`/Volumes/*/.fseventsd/`	—
External Volume Event Files external_eventsPlanned — not collected yetOptionalRequires root	binary	`/Volumes/*/.fseventsd/????????????????`	—
Preboot Volume FSEvents preboot_storeOptionalRequires rootlow value	binary	`/System/Volumes/Preboot/.fseventsd/`macOS 10.15+	—
Recovery Volume FSEvents recovery_storeOptionalRequires rootlow value	binary	`/System/Volumes/Recovery/.fseventsd/`macOS 10.15+	—

config

Artifact	Format	Path	Notes
System Volume UUID system_uuidOptionalRequires rootmedium value	text	`/.fseventsd/fseventsd-uuid`macOS ≤ 10.14 +1 more `/System/Volumes/Data/.fseventsd/fseventsd-uuid`macOS 10.15+	—
External Volume UUIDs external_uuidsPlanned — not collected yetOptionalRequires root	text	`/Volumes/*/.fseventsd/fseventsd-uuid`	—