The root directory of most Mac systems has a hidden directory called
.fseventsd. This holds a log file of file system events. The log file is commonly used in digital forensics investigations, because it holds a list of files touched within particular times.
I'd like to know why the Mac is writing this information to the disk and how often the log is cleaned.
- Why is this log being created?
Really, it makes no sense. It's possible for programs to register to get events having to do with changes in the file system. So why write them to a persistent log in the file system?
- How often is it cleaned?
One of my Macs has been running since Dec 2018. A month ago it had events going all the way back to the day I bought it; now it has events going back to March 2 at 14:47 (I'm typing this on March 16.)
I've looked online and can find information about how to decode the file format, but I really can't find anything about why it is there.
For background on fsevents, see:
- http://nicoleibrahim.com/apple-fsevents-forensics/, Article and Research by Nicole Ibrahim
- https://github.com/dlcowen/FSEventsParser, Free parser
- https://www.crowdstrike.com/blog/using-os-x-fsevents-discover-deleted-malicious-artifact/, Crowd Strike on how to use it in digital forensics.