Skip to content
TCCParser

Glossary

Full Disk Access

The TCC permission kTCCServiceSystemPolicyAllFiles, which lets a program read protected user data such as Mail, Messages, Safari and the TCC databases.

Full Disk Access is the TCC service kTCCServiceSystemPolicyAllFiles. A program that holds it can read data TCC otherwise protects, including Mail, Messages, Safari data and the TCC.db files themselves. It is usually recorded in the system database.

Two sides for investigators: collection tools and the Terminal running them need it to copy TCC.db on a live Mac, and a grant to a terminal or interpreter covers everything launched from it. See investigating TCC permission abuse.