Network
Wi-Fi History
Overview
macOS stores comprehensive Wi-Fi connection history including saved network credentials, connection timestamps, auto-join preferences, and network security settings. Wi-Fi artifacts are valuable for establishing device location history and identifying networks the device has connected to.
This article is under development. Detailed Wi-Fi forensic analysis documentation is coming soon.
Key Forensic Areas
- Known networks: All Wi-Fi networks the device has connected to
- Connection timestamps: When networks were first and last joined
- Auto-join settings: Which networks connect automatically
- Security types: WPA2, WPA3, open network indicators
- Captive portal: Captive network detection history
- Location correlation: Network names can indicate physical locations
File Locations
| File | Path | Description |
|---|---|---|
| Wi-Fi preferences | /Library/Preferences/com.apple.wifi.known-networks.plist | Known networks (macOS 14+) |
| Legacy preferences | /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist | Known networks (legacy) |
| Wi-Fi interface | /Library/Preferences/SystemConfiguration/com.apple.wifi.message-tracer.plist | Wi-Fi diagnostics |