Pro plugin

TCC Database

Collects macOS TCC (Transparency, Consent, and Control) privacy permission records from user and system databases

system.tccPromacOS 10.14+v1.0.0systemprivacypermissions

Run this plugin

Trigger collection for TCC Database on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.tcc --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.tcc --dry-run

Compatibility

macOS 10.14+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (7 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

config

Artifact	Format	Path	Notes
TCC Access Records tcc_access	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more `/Library/Application Support/com.apple.TCC/TCC.db`	Permission grant/deny decisions for camera, microphone, screen recording, full disk access, and 90+ services.
TCC Expired Records tcc_expired	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more `/Library/Application Support/com.apple.TCC/TCC.db`	Previously granted permissions that have been revoked or expired.
TCC Policy Records tcc_policy	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more `/Library/Application Support/com.apple.TCC/TCC.db`	Policy definitions and their active client bindings. Available on macOS 14+ (Sonoma).
TCC Access Overrides tcc_override	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more `/Library/Application Support/com.apple.TCC/TCC.db`	Permission override entries.
TCC MDM Overrides tcc_mdm_override	binary_plist	`/Library/Application Support/com.apple.TCC/MDMOverrides.plist`	MDM-managed permission overrides applied by device management profiles.
TCC Screen Capture Approvals tcc_screen_capture	binary_plist	`~/Library/Group Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist`	Screen capture approval records per application.
TCC Raw Files tcc_raw_filesOptionalOpt-in	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +2 more `/Library/Application Support/com.apple.TCC/TCC.db` `/Library/Application Support/com.apple.TCC/MDMOverrides.plist`	Full TCC database files for offline analysis.