Where Are macOS FSEvents Logs Stored?
macOS .fseventsd directories with file-system event logs per volume.
Last updated
macOS records file creations, modifications, renames and deletions per volume in .fseventsd event logs. Forensics timelines mine them for activity windows long after logs rotate.
Each mounted volume keeps its own logs at the root. Parse them from a disk image since live files roll constantly.
Where macOS stores this, by platform
/.fseventsd
Per-volume event logs with one numbered file per time window. External drives carry their own .fseventsd folders with the same format. Parse offline with fsevents tools; live files rotate under you.
Frequently asked questions
What do FSEvents record?
File creates, modifies, renames and deletes per volume with event IDs and paths. Content changes never appear, only that something happened.
How far back do FSEvents go?
Until the logs roll over from volume activity, often weeks on quiet disks and hours on busy ones. Image early for the longest window.
Notice an outdated path? Let us know.