macOS Artifact Parsing Tool (mac_apt)
A Python-based DFIR framework for extracting forensic artifacts from macOS and iOS disk images or live systems.
What is macOS Artifact Parsing Tool (mac_apt)?
mac_apt is a macOS and iOS Artifact Parsing Tool used in digital forensics to extract investigative data from disk images or live systems. It processes various forensic image formats and uses plugins to parse specific artifacts like browser history, keychains, and system logs, outputting structured data for analysis. The tool solves the need for a comprehensive, automated framework to handle Apple ecosystem artifacts in forensic investigations.
Digital forensics analysts, incident responders, and security researchers who investigate macOS and iOS systems and need to extract and analyze forensic artifacts efficiently.
Developers choose mac_apt for its extensive plugin library covering over 50 macOS/iOS artifacts, support for multiple forensic image formats including live systems, and cross-platform Python implementation without external dependencies like pyobjc.
Overview
macOS (& ios) Artifact Parsing Tool
Use Cases
Best For
- Processing full disk images from macOS systems for forensic investigations
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
