Recent Items & Shared File Lists

Location

Description

Property list files tracking recently accessed applications, documents, servers, and volumes through the macOS Shared File List mechanism. SFL2 files are serialized binary plists containing bookmark data for recently used items across Finder and applications, including network volumes and remote servers.

Forensic Value

Recent Items plists provide evidence of which files, applications, and servers the user accessed most recently, persisting even after the items themselves are removed. The RecentApplications, RecentDocuments, and RecentServers lists reconstruct the user activity pattern. FavoriteServers entries reveal network resources the user regularly connects to, including SMB shares and AFP volumes that may be data exfiltration targets. Bookmark data within each entry contains the full file path and volume information at the time of access.

Tools Required

Collection Commands

for f in ~/Library/Application\ Support/com.apple.sharedfilelist/*.sfl2; do echo "=== $f ===" && plutil -p "$f"; done > /forensics/recent_items.txt

cp -r ~/Library/Application\ Support/com.apple.sharedfilelist/ /forensics/sharedfilelists/

find ~/Library/Application\ Support/com.apple.sharedfilelist/ -name "*.sfl2" -exec stat -f "%Sm %N" -t "%Y-%m-%d %H:%M:%S" {} \; > /forensics/sfl2_timestamps.txt

python mac_apt.py -i /path/to/image -o /forensics/output RECENTITEMS

Collection Constraints

• •Paths, schemas, and permission boundaries vary by macOS release, Full Disk Access state, and whether data came from a live collection, mounted image, or backup source.

MITRE ATT&CK Techniques

References