https://github.com/ydkhatri/MacForensics

Scripts to process macOS forensic artifacts
https://github.com/ydkhatri/MacForensics

forensics mac macos osx

Last synced: 3 months ago
JSON representation

Scripts to process macOS forensic artifacts

• Host: GitHub
• URL: https://github.com/ydkhatri/MacForensics
• Owner: ydkhatri
• Created: 2017-01-05T06:05:53.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2023-01-09T08:25:48.000Z (over 1 year ago)
• Last Synced: 2024-01-22T20:19:29.098Z (5 months ago)
• Topics: forensics, mac, macos, osx
• Language: Python
• Homepage: https://www.swiftforensics.com
• Size: 41.8 MB
• Stars: 157
• Watchers: 12
• Forks: 21
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Lists

• osx-security-awesome - DFIR scripts
• awesome-csirt - MacForensics
• awesome-csirt - MacForensics
• awesome-csirt - MacForensics
• awesome-stars - ydkhatri/MacForensics - Scripts to process macOS forensic artifacts (Python)
• project-awesome - ydkhatri/MacForensics - Scripts to process macOS forensic artifacts (Python)

README

        
# MacForensics

Repository of scripts for processing various artifacts from macOS (formerly OSX).

Artifact | Script Name | Description

-------- | ----------- | ------------

Darwin folders | darwin_path_generator.py | DARWIN_USER_ folders name generation algorithm (those seemingly random folder names under /var/folders/)

Deserialize NSKeyedArchive plists | Deserializer/deserializer.py
Deserializer/deserializer.exe | Converts NSKeyedArchive plists to normal (human-readable) plists (Code + compiled exe for windows)  

Domain (Active Directory) | Domain_Info/Read_ConfigProfiles.py | Reads user profile information for AD domain users from the ConfigProfiles.binary file

DotUnderscore ._ files | DotUnderscore_macos.bt | An 010 template for parsing extended attribute files that begin with ._

Ktx to Png convertor | IOS_KTX_TO_PNG/ios_ktx2png.py
IOS_KTX_TO_PNG/ios_ktx2png.exe | Convert ios created KTX texture images (like app snapshots) to PNG (Code + compiled exe for windows)  

Notifications | macNotifications.py | Parse Mac Notifications db

Office reg file | Read_OfficeRegDB.py | Parse MS Office created sqlite db (microsoftRegistrationDB.reg)