mac_fsevents_search
Search macOS FSEvents records to trace file creation, deletion, modification, and renames. Filter by path, filename, event type, or time range for targeted forensic analysis.
Instructions
Search FSEvents records for file system activity. Shows file creation, deletion, modification, and rename operations.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| time_end | No | ISO datetime - filter events before this time (approximate) | |
| time_start | No | ISO datetime - filter events after this time (approximate) | |
| event_types | No | Filter by event types: created, deleted, modified, renamed, mount, permission | |
| path_filter | No | Filter by full path (substring match) | |
| fseventsd_path | Yes | Path to .fseventsd directory or pre-parsed SQLite database | |
| filename_filter | No | Filter by filename (substring match) |