Compatibility

Collection host

• macOS 12 (Monterey) and newer. This is the minimum for binaries built with Go 1.25. To collect evidence from an older system, collect from its disk image on a supported host with --image, or mount it and use --from.
• arm64 and x86_64. Community releases ship a universal binary; Pro is built for each architecture.

Source types

• Live system. Default. Reads through normal filesystem APIs; respects TCC.
• Disk image file (v0.2.0+). Pass a DMG, raw, or E01 image with --image. macfor attaches it read-only, reads the System and Data volumes as one filesystem, and detaches it afterwards. E01 needs ewfmount (libewf) and macFUSE. See the CLI reference.
• Mounted disk image or directory tree. Mount the image read-only, then pass its root with --from /Volumes/.... The same plugins run against it.
• Sparse / encrypted images. Mount via hdiutil or DiskArbitration, then point macfor at the mount point.

Permissions

The collection process reads files using its own credentials. To reach paths protected by TCC (~/Library/Mail, ~/Library/Messages, ~/Library/Safari, the TCC database itself, …), grant Full Disk Accessto either the terminal you invoke macfor from. Running as root doesn't bypass TCC; only Full Disk Access does. macfor warns before a live collection if it doesn't have it.

macfor doesn't decrypt Chrome passwords or cookies, or Keychain entries: they're collected as opaque values or metadata, and decryption is the analyst's decision. The one exception is Pro's Signal plugin, which opens Signal Desktop's SQLCipher database to parse messages.