Which artifacts on a MacOS system are commonly used by investigators to reconstruct user activity?

• A. Browser history, cookies, and cached web data
• B. Kernel logs and crash dumps
• C. Unified logs (log show), shell history (bash/zsh), and system receipts or lastlogin
• D. Network device configurations and firewall rules

Answer: (C)

MacOS investigators reconstruct user activity by building a timeline from a mix of system-wide logs and user-specific history. The unified logging system, accessed via log show, aggregates events from the OS and applications with precise timestamps, providing a broad view of what happened and when. The user’s shell history (such as Bash or Zsh history files) captures commands entered in terminal sessions, revealing manual actions, software launches, and configuration changes. System receipts, stored in the receipts database, track installed or updated software, which can indicate actions taken on the machine and correlate events across time; lastlogin records show the most recent login times for user accounts, helping establish when a user accessed the system. Taken together, these artifacts give a cohesive timeline of user activity across sessions and system events.

Browser history, cookies, and cached web data can reveal web activity but don’t provide the fuller picture of non-web actions. Kernel logs and crash dumps offer insight into system and driver issues but are less useful for reproducing typical user behavior. Network device configurations and firewall rules describe network posture rather than individual user actions.