$ macfor --version

Changelog

Release notes and changes for macfor products, newest first.

Watch releases on GitHubRead the docs
Latestv0.2.0macfor Collector

macfor Collector 0.2

Collect straight from disk images, gather local user accounts, and pass options to individual plugins. Files collected from the same path are now both kept, and the evidence container format moves to 1.4.

$brew install macfor-io/tap/macfor

Features

Community · free
  • Collection from disk images with --image: DMG, raw (including a whole GPT-partitioned disk) or E01 via ewfmount, attached read-only, collected across the merged System and Data volumes, and detached afterwards
  • New system.users plugin: local accounts from dslocal plists
  • Per-plugin options with --plugin-opt <plugin_id>.<key>=<value>; env: and file: values keep secrets out of shell history
  • Plugin options recorded in the manifest and chain of custody, with secrets masked
  • Files collected from the same path are both kept, each with its own hash
  • Provenance hashes cover the manifest’s source bytes
  • Intel architecture reported as amd64
  • Evidence container format 1.4

For detailed technical information, see the documentation.

v0.1.0macfor Collector

macfor Collector 0.1

The first release of the collector: hashed evidence containers, chain-of-custody documentation and multi-user collection from live systems or mounted disk images, installable with Homebrew. The paid editions add broader artifact coverage.

$brew install macfor-io/tap/macfor

Features

Community · free
  • Shell history collection (Bash, Zsh, Fish, Sh)
  • Safari browser artifact collection
  • Evidence container with SHA-256 hashing
  • Chain of custody documentation
  • Parsed records as JSONL or Parquet
  • Multi-user collection support
  • Collection from live systems or mounted disk images
  • Disk image format detection
  • Full Disk Access detection, recorded in the manifest with the system time zone
  • Exit code 2 for partial collections that recovered from errors
  • CLI with dry-run mode
  • Homebrew cask and universal macOS binary

Pro features

Paid editions
Compare editions →

Browsers

  • Chrome browser artifacts
  • Firefox browser artifacts
  • Arc browser artifacts

System

  • FSEvents journal parsing
  • Unified Logs collection
  • Spotlight metadata
  • Keychain metadata
  • Wi-Fi known networks

Communications

  • Apple Mail collection
  • Messages collection
  • FaceTime call history
  • Contacts collection
  • Apple Notes collection

For detailed technical information, see the documentation.

v0.1.0 is the first macfor release.

Already installed? Stay current.

Upgrade through Homebrew, and watch the GitHub repository to hear about the next release first.

$brew upgrade macfor
Watch on GitHub