{"id":51699320,"url":"https://github.com/LETHAL-FORENSICS/macos-collector","last_synced_at":"2026-08-04T14:00:28.666Z","repository":{"id":321257182,"uuid":"1085144315","full_name":"LETHAL-FORENSICS/macos-collector","owner":"LETHAL-FORENSICS","description":"macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR","archived":false,"fork":false,"pushed_at":"2026-04-13T05:53:17.000Z","size":6522,"stargazers_count":38,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-13T07:37:39.871Z","etag":null,"topics":["apple","dfir","dfir-tools","digital-forensics","forensic-tools","incident-response","macos"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/LETHAL-FORENSICS.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-28T16:35:50.000Z","updated_at":"2026-04-13T05:48:29.000Z","dependencies_parsed_at":"2025-10-28T18:30:05.318Z","dependency_job_id":null,"html_url":"https://github.com/LETHAL-FORENSICS/macos-collector","commit_stats":null,"previous_names":["lethal-forensics/macos-collector"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/LETHAL-FORENSICS/macos-collector","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LETHAL-FORENSICS%2Fmacos-collector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LETHAL-FORENSICS%2Fmacos-collector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LETHAL-FORENSICS%2Fmacos-collector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LETHAL-FORENSICS%2Fmacos-collector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/LETHAL-FORENSICS","download_url":"https://codeload.github.com/LETHAL-FORENSICS/macos-collector/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LETHAL-FORENSICS%2Fmacos-collector/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36277672,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-08-04T02:00:06.901Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","dfir","dfir-tools","digital-forensics","forensic-tools","incident-response","macos"],"created_at":"2026-07-16T09:00:21.748Z","updated_at":"2026-08-04T14:00:28.647Z","avatar_url":"https://github.com/LETHAL-FORENSICS.png","language":"Shell","funding_links":[],"categories":["Challenges"],"sub_categories":["OS X Forensics"],"readme":"\u003cp align=\"center\"\u003e\u003ca href=\"https://github.com/ohmyzsh/ohmyzsh\"\u003e\u003cimg src=\"https://img.shields.io/badge/Language-Shell-blue\" style=\"text-align:center;display:block;\"\u003e\u003c/a\u003e \u003ca href=\"https://github.com/LETHAL-FORENSICS/macos-collector/releases/latest\"\u003e\u003cimg src=\"https://img.shields.io/github/v/release/LETHAL-FORENSICS/macos-collector?label=Release\" style=\"text-align:center;display:block;\"\u003e\u003c/a\u003e \u003cimg src=\"https://img.shields.io/badge/macOS-12.0+-brightgreen\" style=\"text-align:center;display:block;\"\u003e \u003cimg src=\"https://img.shields.io/badge/Maintenance%20Level-Actively%20Developed-brightgreen\" style=\"text-align:center;display:block;\"\u003e \u003ca href=\"https://x.com/LETHAL_DFIR\"\u003e\u003cimg src=\"https://img.shields.io/twitter/follow/LETHAL_DFIR?style=social\" style=\"text-align:center;display:block;\"\u003e\u003c/a\u003e\u003c/p\u003e  \n\n# macos-collector\nmacos-collector - Automated Collection of macOS Forensic Artifacts for DFIR  \n\nmacos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily [Aftermath](https://github.com/jamf/aftermath) by Jamf Threat Labs.  \n\n## Download  \nDownload the latest version of **macos-collector** from the [Releases](https://github.com/LETHAL-FORENSICS/macos-collector/releases/latest) section.  \n\n\u003e [!NOTE]\n\u003e macos-collector includes all external tools by default.  \n\n\u003e [!NOTE]\n`Default Archive Password:` IncidentResponse, `Quarantine Files Password:` infected  \n\n\u003e [!TIP]\n\u003e macos-collector will write the output directly to the current working directory. It is recommended to run the tool from a remote location or external device (such as a USB flash drive) to reduce writing to the actual disk on the target endpoint.  \n\n\u003e [!IMPORTANT]\n\u003e Aftermath needs to be root, as well as have full disk access (FDA) in order to run. FDA can be granted to the Terminal application in which it is running. \n\u003e \n\u003e To give your Terminal application temporarily full disk access, go to `System Settings` \u0026#8594; `Privacy \u0026 Security` \u0026#8594; `Full Disk Access`, click the `+` button, unlock the settings with Touch ID or enter your password, and choose your Terminal application. You will then need to quit and reopen your Terminal application for the changes to take effect. To revoke the access, simply return to the same menu and uncheck your Terminal application.  \n\n## Usage  \n```Shell\nsudo bash macos-collector.sh [OPTION]\n```\n\nExample 1 - Collect forensic artifacts from a compromised macOS endpoint using Aftermath  \n```Shell\nsudo bash macos-collector.sh --collect  \n```\n\nExample 2 - Analyze previous collected Aftermath archive file    \n```Shell\nsudo bash macos-collector.sh --analyze\n```\n\nExample 3 - Collect FSEvents Data from a compromised macOS endpoint   \n```Shell\nsudo bash macos-collector.sh --fsevents  \n```\n\nExample 4 - Collect ALL supported macOS Forensic Artifacts     \n```Shell\nsudo bash macos-collector.sh --triage  \n```\n\n\u003c/br\u003e\n\n![Help-Message](https://github.com/user-attachments/assets/182983c2-854e-4445-b14c-1bb35c07680d)  \n**Fig 1:** Help Message  \n\n![Aftermath-Collection](https://github.com/user-attachments/assets/27d73f2d-c139-446d-b1b6-20f0d4a52fb8)  \n**Fig 2:** Aftermath Collection w/ Deep Scan  \n\n![Aftermath-Analysis](https://github.com/user-attachments/assets/cfa5c6d1-c188-4648-ac7f-111ade15c943)  \n**Fig 3:** Analyzing Aftermath Archive \u0026#8594; switch to a clean macOS endpoint  \n\n![BTM](https://github.com/user-attachments/assets/8b4d7bbd-8b02-4d45-a52f-fcccd9ae1b0b)  \n**Fig 4:** Collecting BTM Dump File (Background Task Management)  \n\n![DS_Store](https://github.com/user-attachments/assets/0af153b0-df11-4ec4-a6de-3fd6fec8cb41)  \n**Fig 5:** Collecting DS_Store Files  \n\n![FSEvents](https://github.com/user-attachments/assets/c3d9a361-8d85-47d4-9da9-08671e038f67)  \n**Fig 6:** Collecting FSEvents Data  \n\n![KnockKnock](https://github.com/user-attachments/assets/69a15eca-54c2-46ad-933b-f95f167c42ed)  \n**Fig 7:** Live System Scan w/ KnockKnock (Persistence)    \n\n![UnifiedLogs](https://github.com/user-attachments/assets/f80a175c-ee1b-4b95-95d3-c3005a009510)  \n**Fig 8:** Collecting Apple Unified Logs (AUL)  \n\n![Sysdiagnose](https://github.com/user-attachments/assets/25e3b02a-a6ed-480f-a10f-1db5eb37376f)  \n**Fig 9:** Collecting Sysdiagnose Logs  \n\n![Spotlight](https://github.com/user-attachments/assets/17dddf9f-819d-4c6b-a7ea-417ec469d0b8)  \n**Fig 10:** Spotlight Database File Collection (incl. Live Searches)  \n\n![SystemInfo-1](https://github.com/user-attachments/assets/e4a3c93b-4dcb-42f4-9233-460fc500bb8a)  \n**Fig 11:** System Information Collection \u0026#8594; XProtect is up to date\n\n![SystemInfo-2](https://github.com/user-attachments/assets/551dc86e-e0e3-4646-98d6-1ef6d19cdfba)  \n**Fig 12:** System Information Collection \u0026#8594; XProtect Update available\n\n![Recent-Items](https://github.com/user-attachments/assets/81d8f279-68e0-4af5-ae18-4c06dddec8e7)  \n**Fig 13:** Recent Items Collection  \n\n![TrueTree](https://github.com/user-attachments/assets/78137d73-362f-4cbf-81c7-b66ea3b31549)  \n**Fig 14:** TrueTree Snapshot Collection  \n\n![Notifications](https://github.com/user-attachments/assets/502af79f-824e-47d6-ba4c-5cdbe57dca51)  \n**Fig 15:** Notification Center Database File Collection  \n\n![Biome](https://github.com/user-attachments/assets/4bb3d8dd-8c2f-47ce-9e99-1ff16878d63a)  \n**Fig 16:** Biome Data Collection (App.MenuItem)    \n\n## Dependencies\n7-Zip v26.00 Console Version (2026-02-12)  \nMD5: DCACF43BE9AC2034815CFEA7E8C89803  \nSHA1: FC8C7FF0F197E7034C3005DF0F653DBFDCCC83EF  \nSHA256: A00F6D085A82A95F6DFC69EA150E05234A12B6D5D134325DDDB964CAE6817488  \nhttps://www.7-zip.org/download.html  \n\nAftermath v2.3.0 (2025-09-24)  \nMD5: A0668EB91650513F40CE8753A277E0E0  \nSHA1: 782077A3FE5351C72157142C437EA5D20BEF00E9  \nSHA256: A58489ACC3E3BB7D5BC70B66DFF5897CBF93BFE38E66C119C4FF1013559D912A  \nhttps://github.com/jamf/aftermath  \n\nKnockKnock v4.0.3 (2025-12-18)  \nMD5: 91582848022442C8A6D71ED28A10A11B  \nSHA1: FDAEB856E44563E7C543F775A238D590A3A4B2EC  \nSHA256: A7836AF427187D02511170606232E4509C3A41351F5BBC3BAFAFE2F0227CC2DE  \nhttps://objective-see.com/products/knockknock.html  \n\nTrueTree v0.8 (2024-08-23)  \nMD5: 7D4ACAA589846B9D31FBC911D1E4898F\nSHA1: BF701DABCFBD816425FB827B75B011773D9283AD\nSHA256: C6CE708937EFAC833DA6A0B6F4FC1A91EB38F8D456317BCF68B27CF57CB581C6\nhttps://github.com/themittenmac/TrueTree  \n\n## License\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.  \n\n## Links\n[Aftermath by Jamf Threat Labs](https://github.com/jamf/aftermath)  \n[Aftermath - SOAR Playbooks](https://github.com/jamf/jamfprotect/tree/main/soar_playbooks/aftermath_collection)  \n[TrueTree by Jaron Bradley](https://github.com/themittenmac/TrueTree)  \n[The Mitten Mac - Incident Response and Threat Hunting Knowledge for macOs](https://themittenmac.com/)  \n[What Happened?: Swiftly Investigating macOS Security Incidents with Aftermath | JNUC 2023](https://www.youtube.com/watch?v=lvfQMnkOZDM)  \n[KnockKnock - Persistence Enumerator by Objective-See](https://objective-see.org/products/knockknock.html)  ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLETHAL-FORENSICS%2Fmacos-collector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FLETHAL-FORENSICS%2Fmacos-collector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLETHAL-FORENSICS%2Fmacos-collector/lists"}