Reconstructing Deleted File Activity Using FSEvents from macOS

The macOS File System Events (FSEvents) mechanism provides efficient notification of filesystem changes for system and application processes. The forensic community does not use this artifact in comparison to other macOS artifacts such as Unified Logs, KnowledgeC, and user-attribution databases. This paper examines the role of FSEvents as a source of historical file system activity, particularly in scenarios where files are no longer present on disk.