Apple File System Events (FSEvents)
| Format | Apple File System Events (FSEvents) |
|---|---|
| Short name | FSEvents |
| Category | log |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Persistent file system event logs stored in /.fseventsd on macOS volumes and also encountered in forensic extractions from iOS and other Apple devices. Each log file is a multi-member gzip stream; the decompressed data consists of pages starting with a '1SLD' (Mac OS X 10.5 to macOS 10.12), '2SLD' (macOS 10.13 and later) or '3SLD' (macOS 14 and later) signature. The records contain an event ID, path, and event flags such as created, modified, renamed, removed, metadata or permission changes; version 2 records add a file system node ID, version 3 records additionally a user ID. FSEvents are primarily directory/file activity indicators rather than a complete audit trail: events can be coalesced, and an event does not necessarily prove that a file was opened or read. The on-disk event records do not provide a conventional per-record timestamp; forensic timelines therefore require correlation with the log files' file system timestamps and other evidence. Log file names are hexadecimal event IDs that provide ordering, not time. FSEvents can preserve evidence of paths and file system activity after the corresponding files or directories have been deleted or are otherwise no longer present.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 31 53 4C 44 | 1SLD | Page signature '1SLD' at offset 0 of the decompressed (gzip) stream |
| offset unknown | 32 53 4C 44 | 2SLD | Page signature '2SLD' at offset 0 of the decompressed (gzip) stream |
| offset unknown | 33 53 4C 44 | 3SLD | Page signature '3SLD' at offset 0 of the decompressed (gzip) stream |
Known extensions
None recorded
References
- MacOS File System Events Disk Log Stream format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20File%20System%20Events%20Disk%20Log%20Stream%20format.asciidoc
- FSEventsParser (G-C Partners) https://github.com/dlcowen/FSEventsParser
Cite this entry
Crush Format Reference, “Apple File System Events (FSEvents)”. https://kalink0.github.io/crush-forensics/formats/fsevents/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction