Community vs Pro

What's the same

• The core orchestrator, evidence container format, and chain-of-custody log.
• The plugin interface, manifest schema, and source abstraction (live system, a disk image file via --image, or a mounted image or directory tree via --from).
• CLI surface. macfor and macfor-pro are flag-compatible; Pro adds exit code 3 when its license check refuses a collection.

Community (3 plugins)

The open-source macfor binary is meant as a working reference: a small, high-value plugin set that exercises every subsystem (text parsers, SQLite, plist, multi-user collection, the full evidence container).

system.users records local account metadata (names, IDs, hidden and service-account flags, Secure Token, creation and password-change times). It never collects password hashes, Kerberos keys, or password hints. On a live system it needs root. Pro includes it too.

• Safari Browser — browser.safari
• Shell History — shell.history
• User Accounts — system.users

Pro (34 plugins)

macfor-pro bundles every community plugin plus the full investigative collection — messaging apps, system telemetry, forensic deep-dives, and binary-format parsers (LevelDB, SQLCipher, SEGB, JSONLZ4, …).

Picking a binary

• Triage / IR scoping. Either works. Community is enough if you only need shell history, Safari, and local user account context.
• Full investigation. Pro. You will want messaging (Signal, Messages, WhatsApp, Telegram, Slack, Discord), TCC, persistence, FSEvents, Unified Logs, and pattern-of-life.
• Air-gapped enterprise.Pro. The license is built into the binary, so there's no online activation step. Contact macfor for procurement.

For pricing and licensing, contact macfor.