browser.safaribrowser.chromebrowser.firefoxbrowser.arcshell.historysystem.usersfilesystem.fseventssystem.unifiedlogssystem.spotlightsystem.quicklooksystem.tccsystem.persistencesystem.quarantinesystem.coreanalyticssystem.patternoflifesystem.screentimesystem.keychainmail.applemessages.applefacetime.applecontacts.addressbookpim.calendarnotes.appledevices.bluetoothnetwork.wifimessaging.signalmessaging.whatsappmessaging.telegrammessaging.fbmessengercommunication.slackapp.discordcloudstorage.dropboxproductivity.evernotedevtools.iterm2browser.safaribrowser.chromebrowser.firefoxbrowser.arcshell.historysystem.usersfilesystem.fseventssystem.unifiedlogssystem.spotlightsystem.quicklooksystem.tccsystem.persistencesystem.quarantinesystem.coreanalyticssystem.patternoflifesystem.screentimesystem.keychainmail.applemessages.applefacetime.applecontacts.addressbookpim.calendarnotes.appledevices.bluetoothnetwork.wifimessaging.signalmessaging.whatsappmessaging.telegrammessaging.fbmessengercommunication.slackapp.discordcloudstorage.dropboxproductivity.evernotedevtools.iterm2browser.safaribrowser.chromebrowser.firefoxbrowser.arcshell.historysystem.usersfilesystem.fseventssystem.unifiedlogssystem.spotlightsystem.quicklooksystem.tccsystem.persistencesystem.quarantinesystem.coreanalyticssystem.patternoflifesystem.screentimesystem.keychainmail.applemessages.applefacetime.applecontacts.addressbookpim.calendarnotes.appledevices.bluetoothnetwork.wifimessaging.signalmessaging.whatsappmessaging.telegrammessaging.fbmessengercommunication.slackapp.discordcloudstorage.dropboxproductivity.evernotedevtools.iterm2

Pull the evidence.Prove it's untouched.

macfor is open-source macOS artifact collection with forensically sound methodology, for DFIR professionals who need evidence from live systems and disk images that survives review.

$brew install macfor-io/tap/macfor

Get started

MIT licensed · macOS 12+

macfor — collect

$ macfor collect --output ir-2026-05.zip

✓ shell.history47

✓ browser.safari1,284

✓ browser.chrome8,917

✓ filesystem.fsevents8,451

✓ system.unifiedlogs92,318

✓ system.spotlight14,206

… and more artifact types

→ ir-2026-05.zipmanifest writtenSHA-256 recorded

Collector plugins: 30+
Hashed at collection: Every file
Chain of custody: Every action
To install: 1 binary

Built for the way investigators actually work.

One static binary. Structured output. Defensible evidence handling. Forensic collection you can trust, and script.

Comprehensive collection

Browser history, shell commands, system logs, FSEvents, Spotlight. 30+ macOS artifact collectors, parsed into structured JSONL.

Forensically sound output

Every run produces an evidence container with a manifest, a chain-of-custody log and a SHA-256 hash for every file.

CLI-first, scriptable

A single static binary. No installer, no GUI, no surprises. Drops straight into your IR playbooks and automation.

Open evidence container

A standard ZIP with a documented format. Load its JSONL records into your SIEM or parse them with your own tools.

What you get from every run.

Broad artifact coverage, evidence anyone can verify, and JSONL your existing tools already read.

COVERAGE

30+ artifacts across browsers, system and user activity.

Safari, Chrome, Firefox, Arc, FSEvents, Unified Logs, Spotlight, Quick Look, Quarantine, TCC, Bluetooth, Wi-Fi networks, persistence mechanisms and more, all parsed into structured JSONL.

artifacts/

chain-of-custody.json

09:14:22Zcollection_startedactor=macfor

09:14:23Zplugin_startedplugin=browser.safari

09:14:23Zfile_addedsha256=9f8a7c1e…

09:14:24Zfile_addedsha256=4e2b81d3…

09:14:24Zplugin_completedplugin=browser.safari

09:15:09Zcollection_completedtotal_records=1284

INTEGRITY

SHA-256 hashing and a full chain of custody.

Every file is hashed at collection time. Every action goes into the custody log. Anyone can re-check the hashes later, so your evidence holds up in review.

COMPOSABILITY

Pipe it into jq. Load it into your SIEM.

Parsed records are JSONL by default, or Parquet if you ask for it. Filter them on the command line, load them into your SIEM, or parse them with your own tools. Your data, your tools.

$ unzip -p ir-2026-05.zip records/browser.safari/parsed.jsonl \
  | jq 'select(.url | contains("github"))'
{
  "url": "https://github.com/macfor-io",
  "title": "macfor-io on GitHub",
  "visit_time": "2026-04-29T11:14:02Z"
}
$ macfor collect --record-format parquet --output ir.zip

Start with the free Collector.

Compare editions

macfor CollectorFree · MIT

The single binary that pulls artifacts off a live Mac or mounted image and seals them in a hashed evidence container with a full chain of custody. Free for personal and commercial use.

Explore Collector Download

Shell history, Safari and user accounts
Evidence container, JSONL and raw files
SHA-256 hashing and chain of custody
Multi-user collection and dry runs

Need more browsers and the system logs?

Professional and Enterprise add Chrome, Firefox and Arc, Unified Logs, FSEvents, Spotlight and Keychain metadata, plus support.

Compare editions →

One command. Evidence ready for analysis.

Install macfor, run macfor collect --output case.zip, and walk away with a hashed evidence container ready for analysis.

$brew install macfor-io/tap/macfor

Read the docs View source

Frequently asked questions

Can't find it here? Ask on GitHub or reach out to the team.

Is the Collector really free?

Yes. It's open source under the MIT license, free for personal and commercial use.

Live systems or disk images?

Both. Collect from a running Mac, or mount a disk image and collect from that.

Is my evidence locked into macfor?

No. The collector and the evidence format are both open source, so your collected evidence stays readable whatever you use next.

Where do I get help?

Community support runs through GitHub. Paid editions add email or dedicated support; see the comparison.