A forensic evidence collection and analysis toolkit for macOS, gathering system data to investigate potential infections.
OSXCollector is a forensic evidence collection and analysis toolkit for macOS. It helps security analysts investigate potentially infected machines by gathering comprehensive system data—including file metadata, browser histories, startup items, and user accounts—into a structured JSON output. The tool is designed to answer critical questions about malware presence, infection vectors, and prevention strategies.
Security analysts, incident responders, and forensic investigators who need to collect and analyze evidence from macOS systems during security incidents or malware investigations.
Developers choose OSXCollector for its simplicity and effectiveness: it's a single-file Python script with zero dependencies, making it easy to run on any macOS system, and it produces detailed, actionable forensic data that integrates with automated analysis pipelines.
A forensic evidence collection & analysis toolkit for OS X
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs as a standalone Python script with no external dependencies, making it easy to deploy on any macOS system with just a copy and execute command, as emphasized in the README.
Collects extensive information from plists, SQLite databases, and file systems, including timestamps, file hashes (MD5, SHA1, SHA2), and user details, covering over 20 sections like startups and browser histories.
Allows selective data gathering via command-line options like `-s` for specific sections, enabling targeted investigations without full system scans, as documented with examples.
Output is designed to integrate with the OSXCollector Output Filters project for automated processing, reducing analyst workload by highlighting suspicious activity, as mentioned in the analysis section.
Relies on the system's default Python 2.7 interpreter; using alternative versions (e.g., from brew) can cause issues, adding setup complexity and potential compatibility headaches.
Exclusively designed for macOS, making it unsuitable for cross-platform forensic environments or investigations involving other operating systems.
Focused on post-incident collection rather than live monitoring, so it lacks features for real-time alerting or continuous endpoint detection and response (EDR).
By default, it does not collect cookies and local storage values to avoid sensitive information, which might hinder forensic analyses unless explicitly enabled with flags like `-c` or `-l`.