https://github.com/LETHAL-FORENSICS/macos-collector
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
https://github.com/LETHAL-FORENSICS/macos-collector
apple dfir dfir-tools digital-forensics forensic-tools incident-response macos
Last synced: 4 days ago
JSON representation
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
- Host: GitHub
- URL: https://github.com/LETHAL-FORENSICS/macos-collector
- Owner: LETHAL-FORENSICS
- License: mit
- Created: 2025-10-28T16:35:50.000Z (9 months ago)
- Default Branch: main
- Last Pushed: 2026-04-13T05:53:17.000Z (4 months ago)
- Last Synced: 2026-04-13T07:37:39.871Z (4 months ago)
- Topics: apple, dfir, dfir-tools, digital-forensics, forensic-tools, incident-response, macos
- Language: Shell
- Homepage:
- Size: 6.22 MB
- Stars: 38
- Watchers: 1
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
- ForensicsTools - MacOs Collector - Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint (Challenges / OS X Forensics)
README
# macos-collector
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily [Aftermath](https://github.com/jamf/aftermath) by Jamf Threat Labs.
## Download
Download the latest version of **macos-collector** from the [Releases](https://github.com/LETHAL-FORENSICS/macos-collector/releases/latest) section.
> [!NOTE]
> macos-collector includes all external tools by default.
> [!NOTE]
`Default Archive Password:` IncidentResponse, `Quarantine Files Password:` infected
> [!TIP]
> macos-collector will write the output directly to the current working directory. It is recommended to run the tool from a remote location or external device (such as a USB flash drive) to reduce writing to the actual disk on the target endpoint.
> [!IMPORTANT]
> Aftermath needs to be root, as well as have full disk access (FDA) in order to run. FDA can be granted to the Terminal application in which it is running.
>
> To give your Terminal application temporarily full disk access, go to `System Settings` → `Privacy & Security` → `Full Disk Access`, click the `+` button, unlock the settings with Touch ID or enter your password, and choose your Terminal application. You will then need to quit and reopen your Terminal application for the changes to take effect. To revoke the access, simply return to the same menu and uncheck your Terminal application.
## Usage
```Shell
sudo bash macos-collector.sh [OPTION]
```
Example 1 - Collect forensic artifacts from a compromised macOS endpoint using Aftermath
```Shell
sudo bash macos-collector.sh --collect
```
Example 2 - Analyze previous collected Aftermath archive file
```Shell
sudo bash macos-collector.sh --analyze
```
Example 3 - Collect FSEvents Data from a compromised macOS endpoint
```Shell
sudo bash macos-collector.sh --fsevents
```
Example 4 - Collect ALL supported macOS Forensic Artifacts
```Shell
sudo bash macos-collector.sh --triage
```
**Fig 1:** Help Message
**Fig 2:** Aftermath Collection w/ Deep Scan
**Fig 3:** Analyzing Aftermath Archive → switch to a clean macOS endpoint
**Fig 4:** Collecting BTM Dump File (Background Task Management)
**Fig 5:** Collecting DS_Store Files
**Fig 6:** Collecting FSEvents Data
**Fig 7:** Live System Scan w/ KnockKnock (Persistence)
**Fig 8:** Collecting Apple Unified Logs (AUL)
**Fig 9:** Collecting Sysdiagnose Logs
**Fig 10:** Spotlight Database File Collection (incl. Live Searches)
**Fig 11:** System Information Collection → XProtect is up to date
**Fig 12:** System Information Collection → XProtect Update available
**Fig 13:** Recent Items Collection
**Fig 14:** TrueTree Snapshot Collection
**Fig 15:** Notification Center Database File Collection
**Fig 16:** Biome Data Collection (App.MenuItem)
## Dependencies
7-Zip v26.00 Console Version (2026-02-12)
MD5: DCACF43BE9AC2034815CFEA7E8C89803
SHA1: FC8C7FF0F197E7034C3005DF0F653DBFDCCC83EF
SHA256: A00F6D085A82A95F6DFC69EA150E05234A12B6D5D134325DDDB964CAE6817488
https://www.7-zip.org/download.html
Aftermath v2.3.0 (2025-09-24)
MD5: A0668EB91650513F40CE8753A277E0E0
SHA1: 782077A3FE5351C72157142C437EA5D20BEF00E9
SHA256: A58489ACC3E3BB7D5BC70B66DFF5897CBF93BFE38E66C119C4FF1013559D912A
https://github.com/jamf/aftermath
KnockKnock v4.0.3 (2025-12-18)
MD5: 91582848022442C8A6D71ED28A10A11B
SHA1: FDAEB856E44563E7C543F775A238D590A3A4B2EC
SHA256: A7836AF427187D02511170606232E4509C3A41351F5BBC3BAFAFE2F0227CC2DE
https://objective-see.com/products/knockknock.html
TrueTree v0.8 (2024-08-23)
MD5: 7D4ACAA589846B9D31FBC911D1E4898F
SHA1: BF701DABCFBD816425FB827B75B011773D9283AD
SHA256: C6CE708937EFAC833DA6A0B6F4FC1A91EB38F8D456317BCF68B27CF57CB581C6
https://github.com/themittenmac/TrueTree
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## Links
[Aftermath by Jamf Threat Labs](https://github.com/jamf/aftermath)
[Aftermath - SOAR Playbooks](https://github.com/jamf/jamfprotect/tree/main/soar_playbooks/aftermath_collection)
[TrueTree by Jaron Bradley](https://github.com/themittenmac/TrueTree)
[The Mitten Mac - Incident Response and Threat Hunting Knowledge for macOs](https://themittenmac.com/)
[What Happened?: Swiftly Investigating macOS Security Incidents with Aftermath | JNUC 2023](https://www.youtube.com/watch?v=lvfQMnkOZDM)
[KnockKnock - Persistence Enumerator by Objective-See](https://objective-see.org/products/knockknock.html)