Nothing to find.

One encrypted disk image, mounted while you work and unmounted the moment you lock.

• The vault is a single AES-256 sparsebundle at ~/Library/Application Support/Custodia/vault.sparsebundle. It grows as you fill it, up to a 2 TB ceiling.
• Unlocked, it mounts at /Volumes/CustodiaVault and stays out of the Finder sidebar. Locked, the only thing on disk is the opaque blob.
• Your password reaches hdiutil over standard input — never as a command argument, where any other process could read it, and never written to disk.
• The vault directory is excluded from Time Machine, so a backup can't quietly carry a second copy somewhere else.

Per-item envelope encryption, so no single key is ever holding the whole library open.

• Your password runs through PBKDF2-HMAC-SHA256, calibrated to about half a second on your device and never below 600,000 iterations.
• That derives a key which wraps a random 256-bit vault key, which in turn wraps one separate key per photo, video and document. Deleting an item means dropping its key.
• No password hash is stored anywhere. The authentication tag on the wrapped vault key is what proves the password was right.
• Face ID is a convenience wrap of that key and not a way around it. Re-enroll a face or change the passcode and the wrap is invalidated — the app falls back to asking for the password.