User Activity
Recent Items
Overview
macOS tracks recently accessed files, applications, and servers through several mechanisms. These artifacts reveal what documents a user opened, which applications they used, and what network resources they accessed — even after the original files are deleted.
This article is under development. Detailed Recent Items forensic analysis documentation is coming soon.
Key Forensic Areas
- Recently opened files: Documents, images, and other files opened by the user
- Recent applications: Applications launched by the user
- Recent servers: Network shares and servers connected to
- Per-application recents: Application-specific recent file lists
- Finder sidebar: Favourites and recent locations in Finder
File Locations
| File | Path | Description |
|---|---|---|
| Recent Items (SFL2) | ~/Library/Application Support/com.apple.sharedfilelist/ | Shared File List v2 files |
| Recent Documents | com.apple.LSSharedFileList.RecentDocuments.sfl2 | Recently opened documents |
| Recent Applications | com.apple.LSSharedFileList.RecentApplications.sfl2 | Recently used apps |
| Recent Servers | com.apple.LSSharedFileList.RecentServers.sfl2 | Recently connected servers |
| Finder Recents | ~/Library/Application Support/com.apple.finder/ | Finder-specific recents |