https://github.com/ydkhatri/MacForensics

Scripts to process macOS forensic artifacts
https://github.com/ydkhatri/MacForensics

forensics mac macos osx

Last synced: 5 days ago
JSON representation

Scripts to process macOS forensic artifacts

• Host: GitHub
• URL: https://github.com/ydkhatri/MacForensics
• Owner: ydkhatri
• Created: 2017-01-05T06:05:53.000Z (almost 8 years ago)
• Default Branch: master
• Last Pushed: 2024-08-04T14:35:10.000Z (3 months ago)
• Last Synced: 2024-08-05T13:05:12.210Z (3 months ago)
• Topics: forensics, mac, macos, osx
• Language: Python
• Homepage: https://www.swiftforensics.com
• Size: 49.2 MB
• Stars: 174
• Watchers: 12
• Forks: 19
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• osx-security-awesome - DFIR scripts
• project-awesome - ydkhatri/MacForensics - Scripts to process macOS forensic artifacts (Python)

README

        
# MacForensics

Repository of scripts for processing various artifacts from macOS (formerly OSX).

Artifact | Script Name | Description

-------- | ----------- | ------------

Darwin folders | darwin_path_generator.py | DARWIN_USER_ folders name generation algorithm (those seemingly random folder names under /var/folders/)

Deserialize NSKeyedArchive plists | Deserializer/deserializer.py
Deserializer/deserializer.exe | Converts NSKeyedArchive plists to normal (human-readable) plists (Code + compiled exe for windows)  

Domain (Active Directory) | Domain_Info/Read_ConfigProfiles.py | Reads user profile information for AD domain users from the ConfigProfiles.binary file

DotUnderscore ._ files | DotUnderscore_macos.bt | An 010 template for parsing extended attribute files that begin with ._

Ktx to Png convertor | IOS_KTX_TO_PNG/ios_ktx2png.py
IOS_KTX_TO_PNG/ios_ktx2png.exe | Convert ios created KTX texture images (like app snapshots) to PNG (Code + compiled exe for windows)  

Notifications | macNotifications.py | Parse Mac Notifications db

Office reg file | Read_OfficeRegDB.py | Parse MS Office created sqlite db (microsoftRegistrationDB.reg)