Quarantine Parser turns Mac download traces into a forensic timeline

Field notes

The collection guide supplies Terminal commands for copying the database with its WAL and journal files, listing attributes, and checking for `.LastGKReject`. It also describes multi-user collection and gives tool-specific routes for UAC, Aftermath and Velociraptor. One important caveat is explicit: UAC does not collect attribute values, so the guide recommends adding a separate Terminal listing.