SEC536: Adversarial AI - Penetration Testing AI Systems


Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsThe macOS File System Events (FSEvents) mechanism provides efficient notification of filesystem changes for system and application processes. The forensic community does not use this artifact in comparison to other macOS artifacts such as Unified Logs, KnowledgeC, and user-attribution databases. This paper examines the role of FSEvents as a source of historical file system activity, particularly in scenarios where files are no longer present on disk.
















