Pro plugin

TCC Database

Collects macOS TCC (Transparency, Consent, and Control) privacy permission records from user and system databases

system.tccPromacOS 10.14+v1.0.0systemprivacypermissions

Run this plugin

Trigger collection for TCC Database on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.tcc --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.tcc --dry-run

Compatibility

macOS 10.14+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (7)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

config

Artifact	Format	Path	Notes
TCC Access Records tcc_access	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more /Library/Application Support/com.apple.TCC/TCC.db	Permission grant/deny decisions for camera, microphone, screen recording, full disk access, and 90+ services.
TCC Expired Records tcc_expired	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more /Library/Application Support/com.apple.TCC/TCC.db	Previously granted permissions that have been revoked or expired.
TCC Policy Records tcc_policy	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more /Library/Application Support/com.apple.TCC/TCC.db	Policy definitions and their active client bindings. Available on macOS 14+ (Sonoma).
TCC Access Overrides tcc_override	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +1 more /Library/Application Support/com.apple.TCC/TCC.db	Permission override entries.
TCC MDM Overrides tcc_mdm_override	binary_plist	`/Library/Application Support/com.apple.TCC/MDMOverrides.plist`	MDM-managed permission overrides applied by device management profiles.
TCC Screen Capture Approvals tcc_screen_capture	binary_plist	`~/Library/Group Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist`	Screen capture approval records per application.
TCC Raw Files tcc_raw_filesOptionalOpt-in	sqlite	`~/Library/Application Support/com.apple.TCC/TCC.db` +2 more /Library/Application Support/com.apple.TCC/TCC.db /Library/Application Support/com.apple.TCC/MDMOverrides.plist	Full TCC database files for offline analysis.