macOS FSEvents — File System Events for Timeline Forensics
A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?
Quick Answer
The answer is FSEvents, stored in the /.fseventsd directory, because it is the macOS artifact that systematically logs file system events such as file creation, modification, and deletion, making it the most reliable source for timeline forensics. Unlike other artifacts that only track metadata or user activity, FSEvents provides a chronological record of changes at the file system level, which is essential for reconstructing user actions and application access on a Mac. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to distinguish between macOS-specific artifacts like FSEvents and more general ones such as plist files or the Unified Log; a common trap is confusing FSEvents with the simpler com.apple.quicklook.thumbnails cache. Remember the mnemonic “FS for File System, Events for Everything” to recall that FSEvents captures all significant file operations for timeline analysis.
⚠ Common exam trap
EC-Council often tests the misconception that bash_history is the primary source for user activity on macOS, but the trap here is that FSEvents provides a more comprehensive and persistent record of file accesses and application launches, including those not performed via the command line.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FSEvents (/.fseventsd)
FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
bash_history
Why it's wrong here
bash_history stores commands entered in the terminal, not file access via GUI.
- ✗
.plist files in ~/Library/Preferences/
Why it's wrong here
.plist files store application preferences, not a comprehensive list of accessed files.
- ✗
Unified Logging (log stream)
Why it's wrong here
Unified logging provides system logs but is not specifically designed for file access history.
- ✓
FSEvents (/.fseventsd)
Why this is correct
FSEvents records file system changes and can be used to reconstruct user activity.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst is examining a Mac system for evidence of recent file access. Which artifact provides a timeline of file system events with high precision and is commonly analyzed using tools like mac_apt?
medium- A.bash_history
- B.Unified Logging
- C..plist files
- ✓ D.FSEvents
Why D: FSEvents (Option D) is the correct answer because it is a macOS kernel-level mechanism that logs file system events (e.g., creation, modification, deletion) with nanosecond precision. Tools like mac_apt parse the FSEventsd database to reconstruct a high-resolution timeline of user and system file activity, making it ideal for forensic timeline analysis.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.