54 Tools

Forensische Parser und Tools für macOS

Alle auf dieser Website genannten Parser und Tools, mit Lizenz und den Artefakten, die sie verarbeiten. Öffnen Sie ein Artefakt, um zu sehen, wie man sie einsetzt.

Tool	Typ	Artefakte
Browser Forensics	Browser	Chrome and Firefox History on macOS Safari History.db
Disk Image Parser	Browser	APFS-Zeitstempel und lokale Snapshots unter macOS Time Machine Backups
FSEvents Parser	Browser	FSEvents (.fseventsd)
Hash Extractor	Browser	iPhone Backups and Pairing Records on a Mac macOS Keychain Files Mounted Disk Images on macOS SSH and Remote Login on macOS
KnowledgeC Parser	Browser	Biome-SEGB-Streams knowledgeC.db
Messaging Forensics	Browser	Apple Mail Messages chat.db
Quarantine Parser	Browser	Gatekeeper- und XProtect-Spuren unter macOS QuarantineEventsV2 und Quarantäne-xattr unter macOS
RAM Parser	Browser	Kernel and System Extensions
TCC Parser	Browser	TCC.db
Unified Log Parser	Browser	Gatekeeper- und XProtect-Spuren unter macOS sudo Logs Unified Logs USB Devices
mac_apt	CLI · Open Source	APFS-Zeitstempel und lokale Snapshots unter macOS Apple Notes NoteStore.sqlite Biome-SEGB-Streams Bluetooth Devices on macOS Chrome and Firefox History on macOS Crash Reports cron, at and periodic CUPS Print Jobs and Logs Dock and Finder Plists dslocal User Accounts FSEvents (.fseventsd) Gatekeeper- und XProtect-Spuren unter macOS iCloud Drive (CloudDocs) InstallHistory.plist iPhone Backups and Pairing Records on a Mac LaunchAgents und LaunchDaemons macOS Trash and .DS_Store Messages chat.db Microsoft Office and Outlook for Mac Mounted Disk Images on macOS netusage.sqlite Notification Center Database QuarantineEventsV2 und Quarantäne-xattr unter macOS QuickLook Thumbnail Cache Recent Items (.sfl2/.sfl3) Safari History.db Saved Application State Screen Sharing and Apple Remote Desktop Artifacts Screen Time Databases Shell-Historie unter macOS Spotlight Store (.Spotlight-V100) sudo Logs System Logs TCC.db Unified Logs USB Devices Wi-Fi Known Networks on macOS
sqlite3	CLI · in macOS enthalten	Apple Mail Apple Notes NoteStore.sqlite Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Chrome and Firefox History on macOS Cloud Storage Clients on Mac Gatekeeper- und XProtect-Spuren unter macOS iCloud Drive (CloudDocs) iPhone Backups and Pairing Records on a Mac Kernel and System Extensions knowledgeC.db macOS Keychain Files Messages chat.db Microsoft Office and Outlook for Mac netusage.sqlite Notification Center Database Photos.sqlite QuarantineEventsV2 und Quarantäne-xattr unter macOS QuickLook Thumbnail Cache Safari History.db Screen Time Databases TCC.db
plutilApple	CLI · in macOS enthalten	Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Cloud Storage Clients on Mac Configuration Profiles and MDM Dock and Finder Plists dslocal User Accounts InstallHistory.plist iPhone Backups and Pairing Records on a Mac Kernel and System Extensions LaunchAgents und LaunchDaemons Microsoft Office and Outlook for Mac QuickLook Thumbnail Cache Recent Items (.sfl2/.sfl3) Safari History.db Saved Application State Screen Sharing and Apple Remote Desktop Artifacts Time Machine Backups Wi-Fi Known Networks on macOS
Plaso	CLI · Open Source	Anmeldeobjekte und BTM-Datenbank unter macOS InstallHistory.plist knowledgeC.db LaunchAgents und LaunchDaemons Messages chat.db Notification Center Database QuarantineEventsV2 und Quarantäne-xattr unter macOS sudo Logs System Logs TCC.db Time Machine Backups Unified Logs
logApple	CLI · in macOS enthalten	Configuration Profiles and MDM Gatekeeper- und XProtect-Spuren unter macOS Mounted Disk Images on macOS Screen Sharing and Apple Remote Desktop Artifacts SSH and Remote Login on macOS sudo Logs Unified Logs USB Devices
APOLLO	CLI · Open Source	Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Kernel and System Extensions knowledgeC.db netusage.sqlite Safari History.db Screen Time Databases
macos-UnifiedLogsMandiant	Bibliothek · Open Source	Configuration Profiles and MDM Screen Sharing and Apple Remote Desktop Artifacts SSH and Remote Login on macOS sudo Logs Unified Logs USB Devices
grep	CLI · in macOS enthalten	Cloud Storage Clients on Mac CUPS Print Jobs and Logs Shell-Historie unter macOS SSH and Remote Login on macOS System Logs
FSEventsParser	CLI · Open Source	Cloud Storage Clients on Mac FSEvents (.fseventsd) Mounted Disk Images on macOS USB Devices
stat	CLI · in macOS enthalten	APFS-Zeitstempel und lokale Snapshots unter macOS macOS Trash and .DS_Store SSH and Remote Login on macOS
Velociraptor	Plattform · Open Source	dslocal User Accounts QuarantineEventsV2 und Quarantäne-xattr unter macOS TCC.db
KnockKnockObjective-See	GUI · Open Source	Kernel and System Extensions LaunchAgents und LaunchDaemons
AftermathJamf	CLI · Open Source	cron, at and periodic
apple_cloud_notes_parserThree Planets Software	CLI · Open Source	Apple Notes NoteStore.sqlite
bgiparser	CLI · Open Source	Anmeldeobjekte und BTM-Datenbank unter macOS
ccl-segbCCL Solutions	Bibliothek · Open Source	Biome-SEGB-Streams
ConsoleApple	GUI · in macOS enthalten	Crash Reports
crontab	CLI · in macOS enthalten	cron, at and periodic
dsclApple	CLI · in macOS enthalten	dslocal User Accounts
DSStoreParser	CLI · Open Source	macOS Trash and .DS_Store
DumpBTMObjective-See	CLI · Open Source	Anmeldeobjekte und BTM-Datenbank unter macOS
emlx	Bibliothek · Open Source	Apple Mail
ExifTool	CLI · Open Source	Photos.sqlite
hdiutilApple	CLI · in macOS enthalten	Mounted Disk Images on macOS
Hindsight	CLI · Open Source	Chrome and Firefox History on macOS
iLEAPP	CLI · Open Source	iPhone Backups and Pairing Records on a Mac
imessage-exporter	CLI · Open Source	Messages chat.db
jq	CLI · in macOS enthalten	Crash Reports
kmutilApple	CLI · in macOS enthalten	Kernel and System Extensions
libfsapfslibyal	Bibliothek · Open Source	APFS-Zeitstempel und lokale Snapshots unter macOS
lpstat	CLI · in macOS enthalten	CUPS Print Jobs and Logs
MVTAmnesty International Security Lab	CLI	iPhone Backups and Pairing Records on a Mac
osxphotos	CLI · Open Source	Photos.sqlite
pkgutilApple	CLI · in macOS enthalten	InstallHistory.plist
profilesApple	CLI · in macOS enthalten	Configuration Profiles and MDM
securityApple	CLI · in macOS enthalten	macOS Keychain Files
sed	CLI · in macOS enthalten	Shell-Historie unter macOS
sfltoolApple	CLI · in macOS enthalten	Anmeldeobjekte und BTM-Datenbank unter macOS
spotlight_parser	CLI · Open Source	Spotlight Store (.Spotlight-V100)
ssh-keygen	CLI · in macOS enthalten	SSH and Remote Login on macOS
syslogApple	CLI · in macOS enthalten	System Logs
systemextensionsctlApple	CLI · in macOS enthalten	Kernel and System Extensions
tmutilApple	CLI · in macOS enthalten	Time Machine Backups
xattrApple	CLI · in macOS enthalten	Mounted Disk Images on macOS