Palo Alto Networks Unit 42 has identified a new forensic artifact in macOS Tahoe 26 that records every user menu selection across the operating system. The artifact, named App.MenuItem, is a Biome stream that captures the exact text of menu items selected by the user along with precise timestamps, providing investigators with a granular record of user intent.
The stream is located at ~/Library/Biome/streams/restricted/App.MenuItem/local and is stored in SEGB-encapsulated protobuf format. Standard forensic tools do not yet parse this stream, but examiners can use open-source utilities like ccl-segb to extract the raw data for analysis.
The value of App.MenuItem lies in its ability to reconstruct user workflows. Where a file system event might simply show a file was deleted, this artifact can show the deliberate sequence of selecting “Move to Trash” followed by “Empty Trash.” In sample analysis, Unit 42 demonstrated a timeline showing a user navigating Finder’s Go to Folder, then saving a document in TextEdit with a specific filename.
Unit 42 researcher Chip Riley noted that the Apple Biome system has long been a gold mine for forensic investigators. The new stream appears designed to facilitate user suggestions or learning behavior but also offers critical context for incident response and digital forensics on the latest macOS version.
