Frequently asked questions

Does macfor modify the source?

No. Files are opened read-only and copied byte-for-byte. The source filesystem is never written to. SHA-256 is computed in-flight and stored in hashes.json for re-verification.

What macOS versions are supported?

The collection host must run macOS 12 (Monterey) or newer, the minimum for binaries built with Go 1.25. Evidence from older systems can still be collected from their disk image with --image, or from a mounted image with --from. Per-plugin artifact versions are listed on the compatibility page.

Will macfor decrypt Keychain entries / Chrome cookies / Signal?

Keychain entries and Chrome cookies: no. Keychain items are collected as metadata only, and Chrome cookie values are kept as the original encrypted_value. Decrypting them is the analyst's call, and is best done in a controlled environment with the right authority.

Signal Desktop is the exception. Its message database is SQLCipher-encrypted, and the Pro messaging.signalplugin uses the key from Signal's config.json to open it and parse messages, conversations, and contacts.

Can I run it against a FileVault-encrypted volume?

Yes — once the volume is unlocked and mounted. Pass the mount point with --from "/Volumes/Macintosh HD". macfor does not handle FileVault unlock itself, and --imageskips an encrypted volume it can't mount, with a warning; use Apple tooling (diskutil, fdesetup) or your acquisition platform.

Why a single-binary collector instead of a plugin loader?

Forensic reproducibility. A statically linked binary is easy to audit: one file to hash, one provenance, one runtime. Plugins are compiled in, not loaded at runtime — every collection produces the same plugin set as the last one with the same binary.

Can I add a plugin?

Yes. The plugin interface is minimal — Info(), Detect(), Collect() — and a per-plugin artifacts.yaml manifest declares the paths. See the Safari plugin as the reference implementation.

How do I integrate with my SIEM / case-management?

The evidence container is a standard ZIP. The parsed records under records/, JSONL by default or Parquet with --record-format, are the easiest ingestion path (Splunk, OpenSearch, DuckDB, Polars). The macfor-analyze platform consumes the same container directly.

Does it work on Apple silicon?

Yes. Community releases ship a universal binary for arm64 and x86_64, and Pro is built for both architectures. The SQLite engine (modernc.org/sqlite) is pure Go, so the community collector is CGO-free. Pro uses SQLCipher (CGO) to open Signal Desktop's encrypted database.