Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.
macOS Artifact Parsing Tool https:// swiftforensics.com
macOS/iOS database location scraper to extract location data
plistutils provides a number of convenience functions for dealing withApple Property List files.
Parser for Apples NSKeyedArchiver plist files.
Library and tools to access the Apple File System (APFS)
afro can parse APFS images. It not only extracts the latest data but also older versions of the files.
Mac malware often spies on users by recording audio and video sessions...sometimes in an undetected manner.
In the Mac OS X and iPhone OS, property list files are files that store serialized objects. Property list files use the filename extension .plist. Mac OS X 10.2 introduced a new format where property list files are stored as binary files. Starting with ... Read More...
mac_int is an interpretive, modular DFIR intelligence and artifact correlation tool designed to automatically identify patterns and connections between parsed artifact data from the SQLite output of Yogesh Khatri’s open source tool, mac_apt... Read More...
macOS Artifact Parsing Tool
© 2019 Copyright | DFIR Training