Apple Unified Log
macOS replaced its text logs with a single binary, compressed, extremely verbose store. It records far more than syslog ever did, and it rolls far faster, which makes it urgent rather than convenient.
where it lives
/var/db/diagnostics/tracev3 files; the payload.
/var/db/uuidtext/The string catalogue. Without it the tracev3 files are largely unreadable, so collect both.
what it proves
- Process launches, network activity, USB attachment, authentication and screen unlocks
- The bundle identifier and signing identity of what ran
- TCC prompts and their answers, which is how you show somebody granted screen recording to something
what it does not prove
- Anything beyond its window, which on a busy Mac is days rather than weeks
- Content of what was transferred
- Anything, readably, if you collected /var/db/diagnostics without /var/db/uuidtext
parsing it
log show / log collectmac_aptUnifiedLogReader
tampering and anti-forensics
Hard to edit selectively because of the compressed binary format, which is a rare case of a format helping the investigator. The realistic evasion is waiting for it to roll.
how long it survives
Days. Collect it first on any macOS engagement.