macOS Forensics

Performing macOS Forensics with FREE Tools in cybersecurity

Many DFIR professionals struggle with macOS analysis because most tools are commercial, but guess what? Below are some FREE tools that can help you do that free of charge for cybersecurity comunity

𝐦𝐚𝐜_𝐚𝐩𝐭
↪️ Yogesh Khatari’s mac_apt is a find-all evidence tool for Mac Forensics. It allows users to process a Mac forensic image using various plugins that target different artifacts. Digital forensics examiners looking to triage a macOS system quickly can benefit significantly from this powerful tool. However, installation can be tricky, and it has not been updated recently.
🔗 github[.]com/ydkhatri/mac_apt

𝐀𝐏𝐎𝐋𝐋𝐎
↪️Developed by Sarah Edwards a few years ago, Apple Pattern of Life Lazy Output’er (APOLLO) targets multiple iOS and Mac databases to extract information and build it into a timeline that examiners can quickly review. APOLLO is a fast, standalone tool that extracts a significant amount of data and places it quickly into the hands of examiners. Unfortunately, the tool has not been updated in a while, so it’s crucial to validate the findings to ensure everything is functioning correctly. Hopefully, an update will be available in the future.
🔗 github[.]com/mac4n6/APOLLO

𝐦𝐚𝐜𝐨𝐬_𝐟𝐬𝐞𝐯𝐞𝐧𝐭𝐬𝐝 𝐩𝐚𝐫𝐬𝐞𝐫
↪️This tool parses fseventsd logs on either a live Mac or a folder containing extracted log files. The parser extracts the entries from the log files and presents them in CSV and JSON files for review. This is a great standalone tool that works well.
🔗 github[.]com/puffyCid/macos-fseventsd

𝐢𝐦𝐞𝐬𝐬𝐚𝐠𝐞_𝐫𝐞𝐚𝐝𝐞𝐫
↪️This tool parses the chat.db file and provides the output in a CSV or SQLite db file. The developer is still working on adding the ability to show attachments. Currently, it only targets the local Mac’s chat.db file, and I have requested the ability to select the location of the db file in order to parse those from a forensic image or another Mac.
🔗github[.]com/niftycode/imessage_reader

𝐦𝐚𝐜𝐨𝐬𝐚𝐜
↪️This tool is useful for collecting macOS artifacts for potential compromise investigations. The tool extracts specific artifacts to a DMG file, which can be analyzed using other tools. There is an .ini file with the configuration for the file search and extraction. If necessary, it appears the .ini file can be modified to fit specific targeting needs.
🔗github[.]com/mnrkbys/macosac

𝐅𝐒𝐄𝐯𝐞𝐧𝐭𝐬 𝐏𝐚𝐫𝐬𝐞𝐫-𝐫𝐬
↪️ This tool also parses fseventsd logs on either a live Mac or a folder containing extracted log files. The parser extracts the entries from the log files and presents them in CSV, JSON, or SQLite files for review. I think including the SQLite db file is a great benefit. This tool is stable and works quickly to get the examiner the data for review.
🔗 github[.]com/Houwenda/FSEventsParser-rs