54 tools

macOS Forensic Parsers and Tools

Every parser and tool referenced on this site, with its licence and the artifacts it handles. Open an artifact for how to use it.

Tool	Type	Artifacts
Browser Forensics	In browser	Chrome and Firefox History on macOS Safari History.db
Disk Image Parser	In browser	APFS Timestamps and Local Snapshots on macOS Time Machine Backups
FSEvents Parser	In browser	FSEvents (.fseventsd)
Hash Extractor	In browser	iPhone Backups and Pairing Records on a Mac macOS Keychain Files Mounted Disk Images on macOS SSH and Remote Login on macOS
KnowledgeC Parser	In browser	Biome SEGB Streams knowledgeC.db
Messaging Forensics	In browser	Apple Mail Messages chat.db
Quarantine Parser	In browser	Gatekeeper and XProtect Evidence on macOS QuarantineEventsV2 and Quarantine xattr on macOS
RAM Parser	In browser	Kernel and System Extensions
TCC Parser	In browser	TCC.db
Unified Log Parser	In browser	Gatekeeper and XProtect Evidence on macOS sudo Logs Unified Logs USB Devices
mac_apt	CLI · open source	APFS Timestamps and Local Snapshots on macOS Apple Notes NoteStore.sqlite Biome SEGB Streams Bluetooth Devices on macOS Chrome and Firefox History on macOS Crash Reports cron, at and periodic CUPS Print Jobs and Logs Dock and Finder Plists dslocal User Accounts FSEvents (.fseventsd) Gatekeeper and XProtect Evidence on macOS iCloud Drive (CloudDocs) InstallHistory.plist iPhone Backups and Pairing Records on a Mac LaunchAgents and LaunchDaemons macOS Trash and .DS_Store Messages chat.db Microsoft Office and Outlook for Mac Mounted Disk Images on macOS netusage.sqlite Notification Center Database QuarantineEventsV2 and Quarantine xattr on macOS QuickLook Thumbnail Cache Recent Items (.sfl2/.sfl3) Safari History.db Saved Application State Screen Sharing and Apple Remote Desktop Artifacts Screen Time Databases Shell History on macOS Spotlight Store (.Spotlight-V100) sudo Logs System Logs TCC.db Unified Logs USB Devices Wi-Fi Known Networks on macOS
sqlite3	CLI · built into macOS	Apple Mail Apple Notes NoteStore.sqlite Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Chrome and Firefox History on macOS Cloud Storage Clients on Mac Gatekeeper and XProtect Evidence on macOS iCloud Drive (CloudDocs) iPhone Backups and Pairing Records on a Mac Kernel and System Extensions knowledgeC.db macOS Keychain Files Messages chat.db Microsoft Office and Outlook for Mac netusage.sqlite Notification Center Database Photos.sqlite QuarantineEventsV2 and Quarantine xattr on macOS QuickLook Thumbnail Cache Safari History.db Screen Time Databases TCC.db
plutilApple	CLI · built into macOS	Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Cloud Storage Clients on Mac Configuration Profiles and MDM Dock and Finder Plists dslocal User Accounts InstallHistory.plist iPhone Backups and Pairing Records on a Mac Kernel and System Extensions LaunchAgents and LaunchDaemons Microsoft Office and Outlook for Mac QuickLook Thumbnail Cache Recent Items (.sfl2/.sfl3) Safari History.db Saved Application State Screen Sharing and Apple Remote Desktop Artifacts Time Machine Backups Wi-Fi Known Networks on macOS
Plaso	CLI · open source	InstallHistory.plist knowledgeC.db LaunchAgents and LaunchDaemons Login Items and BTM Database on macOS Messages chat.db Notification Center Database QuarantineEventsV2 and Quarantine xattr on macOS sudo Logs System Logs TCC.db Time Machine Backups Unified Logs
logApple	CLI · built into macOS	Configuration Profiles and MDM Gatekeeper and XProtect Evidence on macOS Mounted Disk Images on macOS Screen Sharing and Apple Remote Desktop Artifacts SSH and Remote Login on macOS sudo Logs Unified Logs USB Devices
APOLLO	CLI · open source	Bluetooth Devices on macOS Calendar, Contacts and Reminders Databases on macOS Kernel and System Extensions knowledgeC.db netusage.sqlite Safari History.db Screen Time Databases
macos-UnifiedLogsMandiant	Library · open source	Configuration Profiles and MDM Screen Sharing and Apple Remote Desktop Artifacts SSH and Remote Login on macOS sudo Logs Unified Logs USB Devices
grep	CLI · built into macOS	Cloud Storage Clients on Mac CUPS Print Jobs and Logs Shell History on macOS SSH and Remote Login on macOS System Logs
FSEventsParser	CLI · open source	Cloud Storage Clients on Mac FSEvents (.fseventsd) Mounted Disk Images on macOS USB Devices
stat	CLI · built into macOS	APFS Timestamps and Local Snapshots on macOS macOS Trash and .DS_Store SSH and Remote Login on macOS
Velociraptor	Platform · open source	dslocal User Accounts QuarantineEventsV2 and Quarantine xattr on macOS TCC.db
KnockKnockObjective-See	GUI · open source	Kernel and System Extensions LaunchAgents and LaunchDaemons
AftermathJamf	CLI · open source	cron, at and periodic
apple_cloud_notes_parserThree Planets Software	CLI · open source	Apple Notes NoteStore.sqlite
bgiparser	CLI · open source	Login Items and BTM Database on macOS
ccl-segbCCL Solutions	Library · open source	Biome SEGB Streams
ConsoleApple	GUI · built into macOS	Crash Reports
crontab	CLI · built into macOS	cron, at and periodic
dsclApple	CLI · built into macOS	dslocal User Accounts
DSStoreParser	CLI · open source	macOS Trash and .DS_Store
DumpBTMObjective-See	CLI · open source	Login Items and BTM Database on macOS
emlx	Library · open source	Apple Mail
ExifTool	CLI · open source	Photos.sqlite
hdiutilApple	CLI · built into macOS	Mounted Disk Images on macOS
Hindsight	CLI · open source	Chrome and Firefox History on macOS
iLEAPP	CLI · open source	iPhone Backups and Pairing Records on a Mac
imessage-exporter	CLI · open source	Messages chat.db
jq	CLI · built into macOS	Crash Reports
kmutilApple	CLI · built into macOS	Kernel and System Extensions
libfsapfslibyal	Library · open source	APFS Timestamps and Local Snapshots on macOS
lpstat	CLI · built into macOS	CUPS Print Jobs and Logs
MVTAmnesty International Security Lab	CLI	iPhone Backups and Pairing Records on a Mac
osxphotos	CLI · open source	Photos.sqlite
pkgutilApple	CLI · built into macOS	InstallHistory.plist
profilesApple	CLI · built into macOS	Configuration Profiles and MDM
securityApple	CLI · built into macOS	macOS Keychain Files
sed	CLI · built into macOS	Shell History on macOS
sfltoolApple	CLI · built into macOS	Login Items and BTM Database on macOS
spotlight_parser	CLI · open source	Spotlight Store (.Spotlight-V100)
ssh-keygen	CLI · built into macOS	SSH and Remote Login on macOS
syslogApple	CLI · built into macOS	System Logs
systemextensionsctlApple	CLI · built into macOS	Kernel and System Extensions
tmutilApple	CLI · built into macOS	Time Machine Backups
xattrApple	CLI · built into macOS	Mounted Disk Images on macOS