DFIR Tools

0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

The search option of " Commercial " and " FOSS " tools is incomplete. Each listing is being edited to include the additional search option. When all the tools have been edited, this notice will be removed. Until then, searching for "Free" tools will be incomplete as not every tool has been updated to whether it is free or commercial. Best to leave both options UNCHECKED until this notice is removed.

Forensic Utilities - Mac

Add your listing here

Results 1 - 11 of 11 This Category · All Listings

github.com/cugu/afro

afro can parse APFS images. It not only extracts the latest data but also older versions of the files.

Submit review Visit Report

www.paragon-software.com/home/apfs-windows/

Apple File System (APFS) is a new file system for macOS, iOS, and other Apple devices. If you work on Windows computer and want to read APFS-formatted HDD, SSD or flash drive, you need APFS for Windows by Paragon Software.

Submit review Visit Report

github.com/mac4n6/iOS-Frequent-Locations-Dumper

Dump the iOS Frequent Location binary plist files

TypeFree and/or open-source software (FOSS)

Submit review Visit Report

github.com/libyal/libfsapfs

Library and tools to access the Apple File System (APFS)

TypeFree and/or open-source software (FOSS)

Submit review Visit Report

github.com/mac4n6/Mac-Locations-Scraper

macOS/iOS database location scraper to extract location data

TypeFree and/or open-source software (FOSS)

Submit review Visit Report

github.com/mac4n6/macMRU-Parser

Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.

Submit review Visit Report

github.com/ydkhatri/mac_apt

macOS Artifact Parsing Tool https://swiftforensics.com

Submit review Visit Report

packagist.org/packages/org_heigl/nskeyedarchiverparser

Parser for Apples NSKeyedArchiver plist files.

Submit review Visit Report

objective-see.com/products/oversight.html

Mac malware often spies on users by recording audio and video sessions...sometimes in an undetected manner. OverSight monitors a mac's mic and webcam, alerting the user when the internal mic is activated, or whenever a process accesses the webcam.

TypeFree and/or open-source software (FOSS)

Submit review Visit Report

pypi.python.org/pypi/plistutils

plistutils provides a number of convenience functions for dealing withApple Property List files.

Submit review Visit Report

github.com/ydkhatri/spotlight_parser

Read and extract data from macOS spotlight databases  

TypeFree and/or open-source software (FOSS)

Submit review Visit Report