Mac FSEvents: Reconstructing File Modifications and Deletions
During a forensic examination of a Mac system, an investigator needs to recover historical record of file system events, such as file modifications and deletions. Which artifact should they examine?
Quick Answer
The answer is FSEvents. This is the correct artifact because macOS’s FSEvents framework maintains a persistent, chronological binary log of file system changes, including file creation, modification, and deletion, making it invaluable for reconstructing user activity and data loss timelines. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to identify macOS-specific forensic artifacts versus generic file system logs; a common trap is confusing FSEvents with the unified log or systemd journal, which do not focus solely on file-level changes. Remember that FSEvents logs are stored in the .fseventsd directory at the volume root and can be parsed with tools like fseventer or the macOS fs_usage command. A useful memory tip: think “FSEvents = File System Events” — the name itself tells you it’s the go-to source for tracking what happened to files, not just system processes.
⚠ Common exam trap
EC-Council often tests the distinction between general logging mechanisms (Unified logging, Syslog) and macOS-specific file system event tracking (FSEvents), leading candidates to confuse system logs with dedicated file system change journals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FSEvents
FSEvents (File System Events) is a macOS framework that logs historical file system changes, including modifications, deletions, and renames, at the volume level. This data is stored in the `.fseventsd` directory and can be queried using the `fsevents` command or tools like `fs_usage`, making it the primary artifact for recovering a timeline of file system activity on a Mac.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
.plist files
Why it's wrong here
.plist files store application preferences and configurations, not file system events.
- ✗
Unified logging
Why it's wrong here
Unified logging captures system logs, but not specifically file system events.
- ✗
Syslog
Why it's wrong here
Syslog is a logging system, but on Mac it is not the primary source for file system events.
- ✓
FSEvents
Why this is correct
FSEvents is a Mac feature that records changes to the file system, including modifications and deletions.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a Mac forensic examination, an investigator needs to find evidence of recently executed applications and accessed files. Which artifact should the investigator prioritize for reconstructing user activity?
hard- A.bash_history
- B.FSEvents
- ✓ C.Unified logging
- D..plist files in ~/Library/Preferences
Why C: Unified logging (C) is the correct artifact because it centrally records process execution events (application launches) and system/file activity, making it the most suitable for reconstructing user activity. FSEvents only captures file system changes (creation, modification, deletion, renaming) and does not log process execution or file reads. bash_history only covers shell commands, and plist preferences contain app settings rather than a direct record of execution/access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.