Documentation
The macfor collector
Forensically sound macOS artifact collection for live systems and disk images. Built for DFIR practitioners who need evidence that holds up.
macfor is a single-binary collector that walks a macOS source — your live machine or a mounted disk image — and packages every relevant artifact into a hashed, chain-of-custody-tracked evidence container. The collector is plugin driven: each artifact family (browser history, FSEvents, Signal, Spotlight, Unified Logs, …) is owned by one plugin with a declarative artifacts.yaml manifest.
The community binary ships 3 reference plugins. The Pro binary adds 34 more for messaging, system telemetry, and forensic deep-dive collection.
Install →
Get the binary onto your collection host. Homebrew, release archive, or build from source.
Run your first collection →
Five minutes from install to a verified evidence container.
Browse plugins →
All 37 collectors, the on-disk paths they read, and kb articles for deeper analysis.
CLI reference →
Every command, flag, and exit code, with examples for triage and full-system runs.
Design principles
- Forensic soundness. The source is never modified. Every collected file is hashed; every collection action is logged into a chain-of-custody record committed to the evidence container.
- Plugin architecture. Every artifact family is one plugin. New collectors plug in without touching the orchestrator.
- Source abstraction. The same plugin code runs against a live system or a mounted disk image — the source interface absorbs the difference.
- Graceful degradation. A failure in one artifact never stops collection of the rest. Errors are recorded in the manifest, the chain of custody, and the per-plugin log inside the evidence container.
- Secrets left encrypted.Keychain entries are collected as metadata and encrypted cookies as their original encrypted values; macfor doesn't decrypt them. (Pro's Signal plugin is the exception: it opens Signal's encrypted database to parse messages.)
Where to next
If you're investigating a specific artifact (FSEvents, Signal messages, Spotlight metadata, …) jump to the plugin reference. For broader forensic background — schemas, timestamp formats, analysis tradecraft — head to kb.macfor.io.