TCC Database

Overview

The TCC (Transparency, Consent, and Control) database is macOS's permission management system, tracking which applications have been granted or denied access to sensitive resources such as the camera, microphone, location services, contacts, photos, Full Disk Access, screen recording, and accessibility features. TCC databases exist at both the system and user level.

For forensic investigators, TCC records provide direct evidence of which applications accessed (or attempted to access) sensitive system resources, when permissions were granted, and whether the user explicitly approved access or it was set via MDM policy.

Forensic Significance

File Locations

Both are SQLite databases. The WAL and SHM files should be collected alongside the main database.

Database Schema

access table

The primary table storing all permission records.

Common Service Identifiers

auth_reason Values

Key Fields for Analysis

Essential Query

SELECT
    service,
    client,
    client_type,
    auth_value,
    auth_reason,
    datetime(last_modified, 'unixepoch') AS modified_date
FROM access
ORDER BY last_modified DESC;

High-Risk Permissions

-- Apps with Full Disk Access, Accessibility, or Screen Recording
SELECT
    service,
    client,
    CASE auth_value
        WHEN 0 THEN 'Denied'
        WHEN 2 THEN 'Allowed'
        WHEN 3 THEN 'Limited'
        ELSE 'Unknown'
    END AS status,
    datetime(last_modified, 'unixepoch') AS modified_date
FROM access
WHERE service IN (
    'kTCCServiceSystemPolicyAllFiles',
    'kTCCServiceAccessibility',
    'kTCCServiceScreenCapture',
    'kTCCServicePostEvent',
    'kTCCServiceListenEvent'
)
AND auth_value = 2
ORDER BY service, last_modified DESC;

Timestamps

TCC uses standard Unix timestamps (seconds since 1970-01-01 00:00:00 UTC) in the last_modified column.

SELECT datetime(last_modified, 'unixepoch') AS modified_date FROM access;

Analysis Notes

• Malware indicators: Malware often requires Accessibility access (for keylogging or UI manipulation) or Full Disk Access (for data exfiltration). Look for unfamiliar bundle IDs with these permissions.
• Persistence correlation: Cross-reference TCC entries with Launch Agents/Daemons — a persistent agent with Accessibility or FDA access is a high-priority investigation target.
• MDM vs. user grants: auth_reason values of 4 or 5 indicate MDM-managed permissions that the user did not explicitly approve. This is normal in enterprise environments but suspicious on unmanaged systems.
• Denied entries: Applications that were denied access may indicate failed exploitation attempts or tools that were blocked by the user.
• SIP protection: The system-level TCC.db is protected by SIP. On a live system, even root cannot modify it without disabling SIP. A modified system TCC.db on a SIP-enabled system is a strong indicator of compromise.
• Reset detection: If TCC records are unexpectedly absent for common applications, the database may have been reset (via tccutil reset).

Version Differences

Tool Support

References

• Apple TCC Documentation
• TCC Database Forensics - VulnTech
• Objective-See - TCC Research
• SANS FOR518: Mac and iOS Forensic Analysis