Recent Items & Shared File Lists
Location
~/Library/Application Support/com.apple.sharedfilelist/ (various .sfl2 files)Description
Property list files tracking recently accessed applications, documents, servers, and volumes through the macOS Shared File List mechanism. SFL2 files are serialized binary plists containing bookmark data for recently used items across Finder and applications, including network volumes and remote servers.
Forensic Value
Recent Items plists provide evidence of which files, applications, and servers the user accessed most recently, persisting even after the items themselves are removed. The RecentApplications, RecentDocuments, and RecentServers lists reconstruct the user activity pattern. FavoriteServers entries reveal network resources the user regularly connects to, including SMB shares and AFP volumes that may be data exfiltration targets. Bookmark data within each entry contains the full file path and volume information at the time of access.