macfor Analyze · In development
Twelve thousand artifacts.
One line of inquiry.
Analyze opens a Collector evidence container as-is and turns it into a case you can explore, search and question. Every file is checked against the collection's SHA-256 hashes before it's imported.
Early-access updates only.
| TIME (UTC) | SOURCE | SUBJECT | TAG |
|---|---|---|---|
| 2025-05-06 14:22:08 | Browser | mega.nz upload | exfil |
| 2025-05-06 14:18:02 | Unified Log | Kingston DataTraveler 3.0 | usb |
| 2025-05-06 14:17:44 | Plist | ~/Library/LaunchAgents/… | persistence |
| 2025-05-06 14:17:43 | Unified Log | /usr/bin/curl | c2 |
| 2025-05-06 14:11:09 | Browser | invoice-05.zip | |
| 2025-05-06 13:54:21 | Unified Log | osascript | |
| 2025-05-06 13:51:00 | Quarantine | screenshot_v3.dmg | unsigned |
<key>ProgramArguments</key> <array> <string>curl</string> <string>-sL</string> <string>hxxp://…</string> </array> <key>RunAtLoad</key><true/>Open in timeline
Five views. One investigation.
Pivot from a suspicious row to the processes around it, to when it happened, to everything like it — without exporting, re-importing or losing the thread.
Built for Collector
The ZIP you hand over is the case you open.
Analyze imports a Collector evidence container directly. No conversion step, no re-parsing into a format the other side can't check. Every file is verified against the hashes recorded at collection before anything is imported, and the original container is kept read-only so you can re-verify it at any time.
Start with the free Collector$ sudo macfor collect --output case-001.zip
# On your workstation
$ macfor-analyze case create --name "Investigation 2026-001"
$ macfor-analyze import case-001.zip --case <case-id>
Everything between the collection and the report.
Browsers on one timeline
Safari, Chrome and Firefox history lands on the same case timeline as everything else, filterable by user and source.
Local-first AI
Semantic search can run on a local embedding model and the assistant defaults to Ollama. Claude or OpenAI only when you explicitly confirm.
Findings by case
Findings, IOCs and pinned artifacts stay with the case they belong to, each linked to the records behind it.
Reports built as you go
Write the narrative in sections and pin the artifacts that support it, so the report grows with the investigation.
Timeline queries
Filter the timeline by time range, user or source, then export it as JSON for the rest of your toolkit.
API access
EnterpriseA REST API over every case, for integrations and bulk workflows.
Get Analyze before your next Mac case does.
Analyze is in development. Join the waitlist for early access, or tell us what your casework needs from the roadmap.