https://www.quarantineparser.com/en/blog Latest from Blog en Wed, 30 Sep 2026 00:50:48 GMT https://www.quarantineparser.com/en/blog/collect-quarantine-events-uac-aftermath-velociraptor https://www.quarantineparser.com/en/blog/collect-quarantine-events-uac-aftermath-velociraptor How to collect macOS QuarantineEventsV2, its -wal and -journal files, quarantine xattrs and .LastGKReject by hand or with UAC, Aftermath and Velociraptor. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/com-apple-quarantine-xattr-flags https://www.quarantineparser.com/en/blog/com-apple-quarantine-xattr-flags How to decode a com.apple.quarantine value: flag bits such as 0083 and 00c3, the hex timestamp, agent and UUID, with a source and confidence for each flag. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/kmditemwherefroms-vs-quarantine https://www.quarantineparser.com/en/blog/kmditemwherefroms-vs-quarantine Where did this file come from on a Mac? Read kMDItemWhereFroms, compare it with quarantine data, and interpret a missing quarantine attribute. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/lastgkreject-gatekeeper-evidence https://www.quarantineparser.com/en/blog/lastgkreject-gatekeeper-evidence What .LastGKReject records when Gatekeeper blocks an item, where it lives, how to collect it and how to tie the rejection back to a download. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/macos-download-investigation-walkthrough https://www.quarantineparser.com/en/blog/macos-download-investigation-walkthrough A synthetic macOS intrusion worked through with Quarantine Parser: timeline, a recovered deleted row, a Gatekeeper rejection and an AppleDouble on USB. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/quarantineeventsv2-forensics https://www.quarantineparser.com/en/blog/quarantineeventsv2-forensics What the macOS QuarantineEventsV2 database records: LSQuarantineEvent schema, Mac absolute time, type numbers, the xattr UUID join and its limits. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.quarantineparser.com/en/blog/recover-deleted-quarantine-events https://www.quarantineparser.com/en/blog/recover-deleted-quarantine-events How deleted QuarantineEventsV2 rows survive in SQLite freeblocks, freelist pages, WAL frames and journals, how to preserve them and what recovery proves. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT