Get macfor Pro

Get started

Installation

macfor is a single Go binary. Pick the install path that matches your forensic workflow — pre-built release for triage carts, source build for air-gapped environments.

Requirements

  • macOS 12 (Monterey) or newer on the collection host. Evidence from older systems can be collected from a mounted image.
  • Apple silicon (arm64) or Intel (x86_64). Universal binaries are published for tagged releases.
  • Root or admin shell when collecting from any user account other than the currently logged-in one (multi-user collection requires full disk read access).

Option A — Homebrew (recommended)

brew install macfor-io/tap/macfor

# Verify
macfor --version

Option B — Release archive

Grab the latest tagged release from GitHub Releases. Each release ships a universal binary (Apple silicon and Intel) plus a checksums.txtwith the SHA-256 of every archive. Binaries aren't code-signed, so you remove the quarantine attribute yourself.

VERSION=0.2.0   # the release you want, without the leading "v"
BASE=https://github.com/macfor-io/macfor-community/releases/download/v$VERSION

curl -LO "$BASE/macfor_${VERSION}_darwin_all.tar.gz"
curl -LO "$BASE/checksums.txt"

# Verify the checksum before extracting
shasum -a 256 -c --ignore-missing checksums.txt

tar xzf "macfor_${VERSION}_darwin_all.tar.gz" macfor
sudo install -m 0755 macfor /usr/local/bin/macfor
xattr -d com.apple.quarantine /usr/local/bin/macfor 2>/dev/null || true
macfor --version

Option C — Build from source

Useful when you need to verify provenance or run on an air-gapped analyst workstation. Requires Go 1.25.6 or newer.

git clone https://github.com/macfor-io/macfor-community.git
cd macfor-community
make build      # produces ./bin/macfor
sudo install -m 0755 bin/macfor /usr/local/bin/macfor

macfor Pro

The Pro binary (macfor-pro) ships every community plugin plus the additional collectors for Signal, Mail, FaceTime, Spotlight, Unified Logs, FSEvents, and more. It's available after purchase via the macfor.io pricing page. Your license is built into the binary you receive, so there's no activation step. Each collection checks the license, records it in the evidence container, and warns when it's within 30 days of expiry. To confirm the install:

macfor-pro --version
# Lists every loaded plugin (community + pro)
macfor-pro list plugins

Granting Full Disk Access

To read protected paths (~/Library/Mail, ~/Library/Messages, ~/Library/Safari, the TCC databases, etc.) the binary needs Full Disk Access.

  1. Open System Settings → Privacy & Security → Full Disk Access.
  2. Add the terminal you'll run macfor from (Terminal.app, iTerm2, Warp, …), then quit and reopen that app. macOS grants access to the app that launches macfor.
  3. For multi-user collection, run macfor under sudo from an admin user.

macfor never elevates privileges itself. Running under sudodoesn't replace Full Disk Access: root is still blocked from TCC-protected paths. If a path is unreadable, macfor records the error in the evidence container's manifest and chain of custody, and continues. On a live system it warns before collecting if it doesn't have Full Disk Access.

Next steps