Aligned with ISO/IEC 27037:2012

Forensic methodology

Every design decision in macfor puts evidence integrity, reproducibility and documentation first: the pillars of admissible digital evidence. Here's exactly how collection works, and where its limits are.

See the evidence container Read the limitations

01Never modify source evidence
02Document everything
03Verify integrity
04Preserve original data

Guiding principles

Never modify source evidence

macfor never writes to the files it collects. Where a database needs special handling, such as SQLite with an active WAL file, it parses a working copy in the system temp directory and deletes it afterwards. The original is hashed and preserved untouched.

Never alters the contents of source files
Never rewrites source file timestamps
Opens SQLite databases read-only
Runs only read-only system queries

Document everything

Every collection ships with four records, inside the same container as the evidence they describe.

Manifest: What was collected, when, from which system, and by which tool version.
Chain of custody: A timestamped log of every plugin run and every file added.
Hash manifest: A SHA-256 hash of every collected file, record file and log.
Collection logs: Per-plugin progress, plus any errors encountered.

Verify integrity

Every file is hashed with SHA-256 during acquisition and the hashes are stored in hashes.json, so you can:

Verify files haven't changed since collection
Detect transmission errors
Prove evidence integrity in review

Preserve original data

Collectors keep the raw file, copied byte for byte, alongside parsed records as structured JSONL (or Parquet, if you ask for it). Unified Logs is the exception: it's exported with Apple's log tool.

Originals stay available for independent verification
Parsed data is easy to analyse and search
Future parser improvements can be re-run on the originals

ISO/IEC 27037:2012

Four requirements, met in every container.

macfor's methodology aligns with ISO/IEC 27037:2012, the guidelines for identifying, collecting, acquiring and preserving digital evidence.

Relevance

Artifacts are collected for defined forensic value. The artifact catalogue records what each collects, why it matters, and its caveats.

Reliability

Deterministic parsing: the same source file produces the same parsed records. A version-controlled tool with release notes.

Sufficiency

Original files for re-parsing, the tool version, and detailed system context (hardware, OS build, security settings, time zone), all in the container.

Auditability

A timestamped chain of custody, with every error recorded in the manifest, the custody log and the per-plugin collection logs.

The evidence container

A standard ZIP with a fixed structure. Open it with anything, verify it with anything.

evidence-container.zip

├── manifest.json          # metadata├── chain-of-custody.json  # audit trail├── hashes.json            # SHA-256├── artifacts/             # raw files│   └── {category}/{plugin}/files/{user}/├── records/               # parsed│   └── {plugin}/parsed.jsonl└── logs/    └── {plugin}/collection.log

{
  "version": "1.4",
  "collection_id": "550e8400-e29b-41d4-a716-446655440000",
  "tool_version": "0.2.0",
  "collected_at": "2026-01-28T10:30:00Z",
  "completed_at": "2026-01-28T10:30:24Z",
  "source": {
    "type": "live",
    "hostname": "macbook-pro",
    "os_version": "15.1",
    "collection_env": {
      "user": "root",
      "is_root": true,
      "full_disk_access": true
    }
  },
  "plugins": [...],
  "statistics": {
    "total_files": 2,
    "total_records": 1834,
    "total_errors": 0
  },
  "record_format": "jsonl"
}

Best practices

The tool handles integrity. These steps handle the rest.

Before collection
Document the scene
System state, running applications, connected devices.
Photograph if relevant
Screen contents, physical setup.
Consider volatile data
macfor doesn't capture memory or live network state, so use other tools first.
Plan your collection
Decide which artifacts you need.
During collection
Dry-run first
Preview what will be collected with --dry-run.
Run elevated
Use sudoto read every user's home directory.
Grant Full Disk Access
Give your terminal Full Disk Access, or macOS blocks protected artifacts even under sudo.
Watch for errors
Check output for permission or access issues.
Don't interrupt
An interrupted collection doesn't leave a partial container behind.
After collection
Verify the container
Recompute the SHA-256 hashes and compare them with hashes.json.
Document transfer
Log how evidence was moved or copied.
Store securely
Keep containers in access-controlled locations.
Keep the chain going
Record who accessed the evidence, and when.

What macfor doesn't do

macfor collects artifacts. It isn't a disk imager, and we'd rather you know that before the case than after it.

No memory acquisitionVolatile data isn't collected.
No deleted-file recoveryExisting files only, not carved data.
No encryption bypassFileVault volumes must be unlocked.
No live network stateActive connections, ARP and routing tables aren't captured.
No raw image filesMount the image, then point the collector at it with --from.
Not write-free on a live MacParsers use working copies in the system temp directory (deleted afterwards), and reads can update access times depending on mount options.

For comprehensive acquisition, pair macfor with disk imaging and memory forensics tools.

Who should run it

We recommend practitioners using macfor bring:

An understanding of macOS file system structure
Familiarity with common macOS artifacts
Knowledge of chain-of-custody requirements
Experience handling digital evidence

Put the methodology to work.

The Collector is free and open source. Read the code behind every claim on this page.

Get started View source