Get macfor Pro

Reference

Compatibility

Which macOS versions, architectures, and source types are supported — at the binary level and per plugin.

Collection host

  • macOS 10.15 (Catalina) and newer. Older versions are not actively tested.
  • arm64 and x86_64. Universal binaries published with every tagged release.

Source types

  • Live system. Default. Reads through normal filesystem APIs; respects TCC.
  • Mounted disk image. Pass --source image:/Volumes/... after mounting the image read-only. The same plugins run; multi-user collection no longer requires root.
  • Sparse / encrypted images. Mount via hdiutil or DiskArbitration, then point macfor at the mount point.

Permissions

The collection process reads files using its own credentials. To reach paths protected by TCC (~/Library/Mail, ~/Library/Messages, ~/Library/Application Support/Signal, the TCC database itself, …), grant Full Disk Access to either the terminal you invoke macfor from or the macfor binary itself.

macfor never decrypts protected secrets. Encrypted blobs (Chrome passwords/cookies, Keychain entries) are collected as opaque values; decryption is the analyst's decision.

Per-plugin minimum macOS

Below the listed version, the underlying artifact either does not exist or has a meaningfully different on-disk format.

PluginPlugin IDModuleMinimum macOS
Apple Mailmail.applepromacOS 10.12+
Apple Notesnotes.applepromacOS 10.15+
Bluetooth Devicesdevices.bluetoothpromacOS 10.15+
Calendar & Reminderspim.calendarpromacOS 10.12+
Contacts (AddressBook)contacts.addressbookpromacOS 10.12+
CoreAnalyticssystem.coreanalyticspromacOS 10.13+
Discordapp.discordpromacOS 10.13+
Dropboxcloudstorage.dropboxpromacOS 10.12+
Evernoteproductivity.evernotepromacOS 10.15+
Facebook Messenger Desktopmessaging.fbmessengerpromacOS 10.15+
FaceTimefacetime.applepromacOS 10.13+
Firefox Browserbrowser.firefoxpromacOS 10.12+
FSEvents Journalfilesystem.fseventspromacOS 10.5+
Google Chrome Browserbrowser.chromepromacOS 10.12+
Keychain Metadatasystem.keychainpromacOS 10.15+
Messages (iMessage/SMS/RCS)messages.applepromacOS 10.12+
Pattern of Lifesystem.patternoflifepromacOS 10.15+
Persistence Mechanismssystem.persistencepromacOS 10.15+
Quarantine Eventssystem.quarantinepromacOS 10.5+
Quick Look Thumbnailssystem.quicklookpromacOS 10.15+
Safari Browserbrowser.safaricommunitymacOS 10.12+
Screen Timesystem.screentimepromacOS 10.15+
Shell Historyshell.historycommunitymacOS 10.12+
Signal Desktopmessaging.signalpromacOS 10.15+
Slack Desktopcommunication.slackpromacOS 10.13+
Spotlight Metadatasystem.spotlightpromacOS 10.15+
TCC Databasesystem.tccpromacOS 10.14+
Telegram Desktopmessaging.telegrampromacOS 10.13+
Unified Logssystem.unifiedlogspromacOS 10.15+
WhatsApp Desktopmessaging.whatsapppromacOS 10.15+
WiFi Known Networksnetwork.wifipromacOS 10.15+