kMDItemWhereFroms vs the macOS Quarantine Attribute
Where did this file come from on a Mac? Read kMDItemWhereFroms, compare it with quarantine data, and interpret a missing quarantine attribute.
Posts tagged: #dfir
.LastGKReject: Gatekeeper Rejection Evidence on macOS
What .LastGKReject records when Gatekeeper blocks an item, where it lives, how to collect it and how to tie the rejection back to a download.
macOS Download Forensics: An Investigation Walkthrough
A synthetic macOS intrusion worked through with Quarantine Parser: timeline, a recovered deleted row, a Gatekeeper rejection and an AppleDouble on USB.