Collect QuarantineEventsV2: UAC, Aftermath, Velociraptor
How to collect macOS QuarantineEventsV2, its -wal and -journal files, quarantine xattrs and .LastGKReject by hand or with UAC, Aftermath and Velociraptor.
Blog
Guides to macOS download provenance for incident responders: QuarantineEventsV2, quarantine flags, WhereFroms, Gatekeeper and deleted-row recovery.
com.apple.quarantine Flags: Reading the Quarantine xattr
How to decode a com.apple.quarantine value: flag bits such as 0083 and 00c3, the hex timestamp, agent and UUID, with a source and confidence for each flag.
kMDItemWhereFroms vs the macOS Quarantine Attribute
Where did this file come from on a Mac? Read kMDItemWhereFroms, compare it with quarantine data, and interpret a missing quarantine attribute.
.LastGKReject: Gatekeeper Rejection Evidence on macOS
What .LastGKReject records when Gatekeeper blocks an item, where it lives, how to collect it and how to tie the rejection back to a download.
macOS Download Forensics: An Investigation Walkthrough
A synthetic macOS intrusion worked through with Quarantine Parser: timeline, a recovered deleted row, a Gatekeeper rejection and an AppleDouble on USB.
QuarantineEventsV2: macOS Download History Forensics
What the macOS QuarantineEventsV2 database records: LSQuarantineEvent schema, Mac absolute time, type numbers, the xattr UUID join and its limits.
Recover Deleted QuarantineEventsV2 Records
How deleted QuarantineEventsV2 rows survive in SQLite freeblocks, freelist pages, WAL frames and journals, how to preserve them and what recovery proves.