IT Forensics · macOS

Forensic analysis of Launch Services – evaluating app and document mappings on macOS

Launch Services is a macOS system component for managing the opening of applications, documents and URLs. Among other things, Apple documents the assignment of preferred applications to document and URL types, the registration of supported file types, and the maintenance of content for the ‘Recently Used’ menu.

Enquire without obligation

For forensic analysis, Launch Services is therefore of interest as a source of context for installed or registered applications, file type associations and certain ‘Recent Items’ references. However, a registration or association does not prove that a particular document was actually opened by a specific person.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We analyse existing Launch Services-related data and technically categorise registered applications, bundle identifiers, document and URL types, and other available mappings. Relevant findings are cross-referenced with installed app bundles, file metadata, ‘Recent Items’ artefacts, Unified Logs and other usage artefacts.

A strict distinction is made between system registration, preferred app assignment and verifiable actual usage.

Typical areas of application

•Analysis of installed and registered applications
•Analysis of document and URL mappings
•Supplement to the ‘Recent Items’ studies
•Reconstruction of app contexts
•Malware and incident response analyses
•Correlation with file and user activities
•Judicial and non-judicial expert reports

This is how the forensic investigation is carried out

Once the data has been securely backed up, any available Launch Services data sets are identified and cross-referenced with the system’s app inventory. Bundle information and file type or URL mappings are documented.

Where data relating to recent items or usage is available, this is correlated with other artefacts. The mere fact that an application has been registered does not imply that it has been run or that a specific user action has taken place.

Why is this area of investigation relevant to forensics?

Launch Services forms an important part of the macOS application and document infrastructure. The data can explain which application was intended for a particular file type, what app information was known to the system, or the context in which other artefacts should be understood.

From a forensic perspective, the distinction between configuration and usage is particularly crucial. A registered app bundle is, initially, a system state; actual launch or the opening of a document requires additional evidence.

Frequently Asked Questions

What does Launch Services do?+
Launch Services helps macOS open apps, documents and URLs, as well as assign preferred applications.
Can Launch Services manage information relating to ‘Recent Items’?+
Yes. Apple states that Launch Services can manage and update the contents of the ‘Recent Items’ menu.
Does a registered application prove that it has been run?+
No. Registration and actual execution are two different matters.
Can Launch Services help with document forensics?+
Yes, particularly as a context for file type and app associations; however, specific usage must be supported by further evidence.

LanCologne – macOS Forensics in Cologne

Do you need a professional analysis of launch service and app mapping data? LanCologne can assist you in ensuring the data is admissible in court and providing a traceable technical classification.

Get in touch now