01Location
- /.fseventsd/
- /System/Volumes/Data/.fseventsd/
- /Volumes/<volume>/.fseventsd/
02Questions it answers
- Did a file or folder path exist on the volume, even after deletion?
- Was a path created, renamed, modified or removed?
- In which order did changes happen relative to each other?
- Were volumes mounted or unmounted?
03Format and versions
| Format | Series of gzip-compressed files at the root of each volume. Each file is a multi-member GZIP stream of disk log streams: 12-byte header with signature 1SLD or 2SLD, then records of path (NUL-terminated), 8-byte event ID, 4-byte flags and, in version 2, an 8-byte node ID. |
|---|---|
| Applies to | Format version 1 in Mac OS X 10.5 through macOS 10.12, version 2 from 10.13 (libyal documentation). Apple states that the on-disk format may change at any time; validate later releases. |
04Key fields
| Field | What it tells you |
|---|---|
| Path | Full path of the changed item as recorded by fseventsd. |
| Event identifier (8 bytes) | Increasing identifier; Apple states event IDs are persistent and increase per host or per disk. |
| Event flags (4 bytes) | 0x01 Created, 0x02 Removed, 0x04 InodeMetadataModified, 0x08 Renamed, 0x10 Modified, 0x80 DirectoryCreated, 0x200 ExtendedAttributeModified, 0x800000 IsFile, 0x1000000 IsDirectory, 0x2000000 Mount, 0x4000000 Unmount. |
| Node identifier (version 2) | 8-byte node identifier added in the version 2 record. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| (none in records) | — | Records hold no time. Order comes from event IDs; dating requires correlation with other artifacts or with the times of the log files themselves. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy the entire .fseventsd directory from each volume, including the Data volume on APFS systems.
- Decompress each file, check the 1SLD/2SLD signature and parse records with a parser that supports the version.
- Decode the flags bit by bit; one record can combine several flags.
- Bound event ID ranges in time using artifacts that do carry timestamps, and report those bounds rather than exact times.
07Interpretation pitfalls
- Apple says the files should not be used directly because the format may change; parser output must be validated per macOS version.
- Logging can be disabled per volume with an empty .fseventsd/no_log file.
- The daemon coalesces notifications, and a volume modified by an older OS can have its history discarded.
- Directory names can linger after deletion (Apple), so a path shows prior existence, not current presence.
09Sources
- libyal dtformats — MacOS File System Events Disk Log Stream format Joachim Metz (GitHub) · checked 2026-10-14
- File System Events Programming Guide — File System Event Security Apple Developer Documentation Archive · checked 2026-10-14
- File System Events Programming Guide — Using the File System Events API Apple Developer Documentation Archive · checked 2026-10-14
- File System Events Programming Guide — Technology Overview Apple Developer Documentation Archive · checked 2026-10-14
- ForensicArtifacts — artifacts/data/macos.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14