macfor Collector

Overview

macfor Collector is a command-line tool that extracts forensic artifacts from macOS systems. Built in Go for speed and portability, it produces forensically sound evidence containers with full chain-of-custody documentation.

Key features

Comprehensive artifact coverage

Shell history

Bash, Zsh, Fish, and Sh command history with native timestamp parsing for each shell's format.

Browser data

Safari history, bookmarks, cookies, downloads, and form data — with Chrome, Firefox, and Edge in Professional.

System logs

Unified Logs (tracev3), FSEvents file system journal, and Spotlight metadata stores.

User activity

Recent documents, application usage records, login items, and per-user preferences.

Forensically sound

Every collection includes SHA-256 hash verification for all collected files, a timestamped chain-of-custody log, a collection manifest with tool version and system info, and evidence containers in standard ZIP format.

Fast and portable

A single binary with no runtime dependencies. Runs on Intel and Apple Silicon, supports macOS 10.15 (Catalina) through current. Typical collections complete in under 60 seconds.

Installation

# Download the latest release
curl -L https://github.com/macforensics/macfor/releases/latest/download/macfor-darwin-amd64 -o macfor
chmod +x macfor

# Verify the download (recommended)
shasum -a 256 macfor

Quick start

# Collect all artifacts (requires sudo for multi-user)
sudo ./macfor collect --output evidence.zip

# Collect specific artifact types
./macfor collect --plugin shell.history --output shell-evidence.zip

# Preview what would be collected (dry run)
./macfor collect --dry-run

Community vs Professional

Feature	Community Free	Professional $169/user/mo
Artifacts
Shell history
Safari
Chrome, Firefox, Edge
Unified Logs
FSEvents
Spotlight metadata
Support
Priority email support

Documentation

Source code

macfor Collector Community Edition is open source under the MIT license. View on GitHub.