Wi-Fi & Airport Connection Logs

Location

Description

Wi-Fi subsystem logs capturing wireless network association and disassociation events, SSID and BSSID information, signal strength, authentication type, and connection state changes. On modern macOS versions, Wi-Fi events are primarily recorded in the Unified Log under the com.apple.wifi subsystem, while legacy systems used the /var/log/wifi.log text file.

Forensic Value

Wi-Fi logs establish which wireless networks the system connected to and when, providing physical location context for the investigation timeline. Connection events to unknown or suspicious SSIDs may indicate evil twin attacks or rogue access point compromise. The BSSID (MAC address of the access point) enables correlation with physical network infrastructure. Frequent reconnection attempts or authentication failures suggest wireless deauthentication attacks. Wi-Fi connection history combined with airport preferences data creates a comprehensive wireless network usage profile.

Tools Required