A Python-based DFIR framework for extracting forensic artifacts from macOS and iOS disk images or live systems.
mac_apt is a macOS and iOS Artifact Parsing Tool used in digital forensics to extract investigative data from disk images or live systems. It processes various forensic image formats and uses plugins to parse specific artifacts like browser history, keychains, and system logs, outputting structured data for analysis. The tool solves the need for a comprehensive, automated framework to handle Apple ecosystem artifacts in forensic investigations.
Digital forensics analysts, incident responders, and security researchers who investigate macOS and iOS systems and need to extract and analyze forensic artifacts efficiently.
Developers choose mac_apt for its extensive plugin library covering over 50 macOS/iOS artifacts, support for multiple forensic image formats including live systems, and cross-platform Python implementation without external dependencies like pyobjc.
macOS (& ios) Artifact Parsing Tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Works on Windows and macOS without pyobjc dependencies, making it accessible on common forensic platforms as highlighted in the README.
Processes E01, VMDK, AFF4, DD, DMG, and more, including compressed formats like zlib and lzfse, ensuring compatibility with various forensic collections.
Exports data to XLSX, CSV, TSV, JSONL, and SQLite, allowing seamless integration with analysis tools and databases per the features list.
Over 50 plugins for key artifacts like Safari history, keychains, and iMessage, providing thorough evidence extraction for forensic investigations.
Plugins for BIOME and KnowledgeC are listed as 'Coming soon,' indicating gaps in parsing newer macOS/iOS system data that investigators might need.
The unified logs plugin was removed due to performance issues, forcing users to depend on separate tools like a Rust-based alternative for critical log analysis.
Requires Python 3.9 or above and running from code, which can be challenging for users unfamiliar with Python environments or those on restricted systems.