CHFI Unified logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  syslog

  Why it's wrong here

  syslog on macOS is a legacy logging facility inherited from BSD, typically written as unstructured plain-text messages to /var/log. While some daemons still emit syslog-compatible entries, it lacks the structured metadata, high-level event categorization, and query capabilities needed for forensics on modern macOS. High-level events like user logins or app launches are not reliably recorded in syslog, and Apple has deprecated it in favor of the unified logging system, making it an incomplete source for this question.

• ✗

  FSEvents

  Why it's wrong here

  FSEvents is a kernel-level API that records changes to the file system hierarchy, such as file and directory modifications, within a persistent per-volume log. It is used by services like Spotlight and Time Machine to track file system activity, but it does not capture process executions, authentication events, or application launches. As a result, FSEvents is valuable for tracking file access or deletion timelines but cannot serve as a source for high-level user or system events required in this context.

• ✗

  .plist files

  Why it's wrong here

  .plist files are property-list files used to store application preferences, user defaults, and configuration data in either XML or binary format. Although they may contain timestamps or recent entries, they are fundamentally configuration artifacts, not event logs or timelines of user actions. They do not systematically record application launches, logins, or other high-level events, and any relevant timestamps are incidental rather than part of a structured audit trail.

• ✓

  Unified logging

  Why this is correct

  Unified logging is the modern, centralized logging architecture on macOS, introduced in macOS 10.12, which aggregates all system and user-level log messages into a high-performance, structured data store accessible via the `log` command and Console app. It captures high-level forensic events such as logon/logoff, application launches, and background daemon activity, along with rich metadata like timestamps, process IDs, and privacy-annotated content. This makes Unified logging the authoritative artifact for investigating high-level system events because it provides a unified, queryable, and tamper-resistant timeline of system activity.