All plugins

Collects Safari browsing history, downloads, bookmarks, cookies, extensions, local storage, and session data

Collects bash, zsh, sh, and fish shell history files and parses commands with timestamps

Collects Apple Mail.app artifacts including message metadata, EMLX files, account configuration, and AI categorization

Collects Apple Notes.app forensic artifacts including note content, metadata, attachments, and collaboration data

Collects Bluetooth device pairing history, connection events, radio state, and audio session data from macOS system plists, KnowledgeC, and PowerLog

Collects Calendar.app events, participants, locations, suggested travel bookings, and Reminders.app tasks, triggers, tags, and change history from macOS

Collects contact records, phone numbers, email addresses, change history, and photos from macOS AddressBook

Collects macOS CoreAnalytics program execution evidence, application usage metrics, system telemetry, and DiagnosticMessages from the analyticsd subsystem

Collects tokens, messages, cache, server metadata, webhook indicators, and activity artifacts from Discord Desktop

Collects file cache metadata, deleted file records, account configuration, and preferences from Dropbox Desktop encrypted databases

Collects Evernote note content, notebooks, tags, attachments, and web clipper source URLs from both legacy .exb SQLite databases and the v10+ Electron conduit-storage format.

Collects chat messages, conversation threads, contacts, payment records, search activity, call history, and cached media from the discontinued Facebook Messenger Desktop app

Collects FaceTime call records, phone call history, and FaceTime Links from macOS

Collects Firefox browsing history, downloads, bookmarks, cookies, form history, logins, extensions, and sessions

Collects and parses macOS FSEvents filesystem event journal for file activity timeline reconstruction

Collects Chrome browsing history, downloads, bookmarks, cookies, autofill, extensions, local storage, and sessions

Collects macOS Keychain item metadata (labels, accounts, services, timestamps, protection classes) without extracting secrets

Collects iMessage, SMS, MMS, and RCS conversations, attachments, reactions, and deleted messages from macOS Messages.app

Collects macOS behavioral databases including KnowledgeC activity records, Biome SEGB stream data, Screen Time usage, InteractionC contact interactions, and DuetActivityScheduler scheduling records

Inventories macOS persistence mechanisms including launch items, login items, scheduled tasks, shell configs, kernel/system extensions, authorization plugins, configuration profiles, and legacy persistence vectors

Collects macOS Quarantine Events from per-user QuarantineEventsV2 databases tracking downloaded files and their sources

Collects Quick Look thumbnail cache metadata, extracted thumbnail images, and raw cache files from macOS

Collects Screen Time restrictions, family management, installed apps, and usage analytics from RMAdminStore databases

Collects messages, conversations, contacts, attachments, and security artifacts from Signal Desktop encrypted databases

Collects workspace metadata, cached messages, authentication tokens, application logs, and user profiles from Slack Desktop local storage

Collects Spotlight search shortcuts, preferences, volume configuration, and raw metadata stores from macOS

Collects macOS TCC (Transparency, Consent, and Control) privacy permission records from user and system databases

Collects account data, media cache, sessions, and diagnostic artifacts from Telegram Desktop local storage (tdata)

Preserves macOS Unified Logging stores (/var/db/diagnostics, /var/db/uuidtext), generates a sealed .logarchive via `log collect`, and renders six predicate-filtered NDJSON event extracts (auth, usb, network, exec, xprotect, tcc) via `log show`.

Collects chat messages, search indices, contacts, group metadata, session threads, delivery receipts, iCloud backup state, and cached media from WhatsApp Desktop local storage

Collects WiFi known networks, legacy airport preferences, association history, interface configuration, and DHCP leases from macOS