New macOS Tahoe 26 artefact logs menu choices for forensic probes

The article discusses a newly discovered artifact called App.MenuItem in macOS Tahoe 26, highlighting its significance for forensic investigations. This artifact logs user actions, providing insights into menu selections across the system, which can reconstruct user intent during investigations. Key points include the artifact's location within the file system, its complexity due to the SEGB file format, and how it can be parsed using specific tools.

The ability to track user interactions, such as file compressions and trash management, offers valuable context that standard logs may miss. However, limitations exist, particularly with generic menu options that lack specific target visibility. The discovery encourages forensic examiners to incorporate this artifact into their workflows for a more comprehensive understanding of user behavior.