QuarantineEventsV2: macOS Download History Forensics
What the macOS QuarantineEventsV2 database records: LSQuarantineEvent schema, Mac absolute time, type numbers, the xattr UUID join and its limits.
Posts tagged: #sqlite
Recover Deleted QuarantineEventsV2 Records
How deleted QuarantineEventsV2 rows survive in SQLite freeblocks, freelist pages, WAL frames and journals, how to preserve them and what recovery proves.