Our mission
macfor exists to make macOS forensics accessible, reliable and forensically sound.
We believe high-quality forensic tools shouldn't require enterprise budgets, and that the forensic community benefits when core tools are open source.
The problem we solve
For years, the digital forensics industry has treated macOS as an afterthought. Windows tools dominate the market, and Mac support often means basic file system browsing without any understanding of macOS-specific artifacts.
Meanwhile, Mac adoption keeps growing: in enterprises, creative industries and among security-conscious users. When incidents happen on these systems, investigators are often left with inadequate tools or manual collection.
Our approach
macfor takes a different approach, in three parts.
macOS-first design
Every artifact parser is built specifically for macOS. We don't port Windows code or borrow assumptions from other operating systems. We study Apple's documentation, reverse-engineer undocumented formats, and test across macOS versions.
Open-source foundation
The Collector Community Edition is open source under the MIT license, which means:
- Anyone can inspect exactly what's collected
- The community can contribute improvements
- Researchers can extend it for their needs
- No vendor lock-in for the evidence format
Commercial sustainability
Professional and Enterprise editions add advanced artifact support and priority support, and fund the work. That hybrid model means:
- Core functionality stays free and open
- Revenue funds ongoing development
- Enterprise users get the support they need
- The project stays sustainable long-term
Our team
macfor was founded by forensic practitioners who hit the macOS tooling gap first-hand. The team combines deep macOS expertise with software engineering experience from leading technology companies.
We're a small, focused team based in Australia, building the best macOS forensic tools in the world.
- Founded by practitioners
- Small, focused team
- Based in Australia
Our values
Forensic integrity
Evidence integrity is non-negotiable. We never cut corners that could compromise the reliability of collected evidence.
Transparency
Open-source code, a documented methodology and a public roadmap, so you always know what macfor does and where it's headed.
Community
We work with the forensic community on GitHub, Discord and at industry events. Your feedback sets our priorities.
Continuous improvement
macOS changes constantly, and so do we. Regular updates keep macfor current with new artifacts and macOS versions.
Contact us
- General inquiries
- hello@macfor.io
- Security issues
- security@macfor.io
- GitHub
- github.com/macfor-io
- Discord
- Join our community