What happened on this Mac?

Appening reads the logs and preference files macOS already keeps and lays them out on one time line: ten columns side by side, one time axis, every event with its evidence. Pick your home folder once, scan, and read. Nothing leaves the Mac — the app has no network access at all.

Mac App Store How it works

The whole history of a Mac on one time line — four years, ten columns — and a scroll through what it remembers.

The time line: ten columns — Apps, Devices, Networks, Downloads, Sessions, Problems, Permissions, System, Terminal, Usage — under a density strip of every day, with day headers and events in cells — Every column on one time axis. The strip above is every day of the recorded history; drag a selection or zoom, and the columns follow.

A detail row open under a clicked event: its details, the file it came from with Show in Finder, and the related events with their time offsets — Click an event: its details, the file it came from, and what happened around it — the download before an install, the permission asked right after.

Settings: the granted home folder, Full Disk Access state with a button to System Settings, why some things are missing, and the sources of the last scan with counts — Settings says exactly what was read, what needs Full Disk Access, and what no App Store app can read at all.

How it works

Apps. Installed, updated, in the Dock — with versions and the installer that did it.
Devices. USB devices plugged in and pulled out, with names and how long; Bluetooth connections with models.
Networks. When the Wi-Fi network changed, when a wired link came up or down.
Downloads. Every file a browser, mail client or AirDrop delivered — from which address, by which app, when.
Sessions. Logins and logouts with their length; sleeps and wakes.
Problems. Every crash, hang and kernel panic report.
Permissions. Which app was allowed or refused the camera, microphone, screen, disk — and when.
System. Boots, shutdowns, macOS updates, time changes.
Terminal. The shell's own history; sudo, curl | sh, rm -rf and the like are marked.
Usage. Which app was in use and for how long, per day.

Events that belong together are linked: the download that preceded an install, the permission an app asked for right after, the command typed while a USB stick was in. Search everything; export the visible range as PDF or CSV.

What it does not do

It does not judge. There is no score and no "suspicious"; events are shown with their evidence and you read them
No server, no account, no network. The app is sandboxed without the network entitlement
It does not watch. It reads what is already on disk when you press Scan
It cannot read what no App Store app can: the file-system journal, Wi-Fi network names, user account records — Settings lists them

Permissions, Usage and the system's crash reports need Full Disk Access; the app says so and works without it. English and Turkish. Requires macOS 26 on Apple silicon.

How it works

What it does not do

Be there on day one