Collect a Mac.
Hand over proof.
Collector pulls shell history, Safari and local user accounts from a live Mac (paid editions add Unified Logs, FSEvents, Spotlight and 25+ more), and records every step in a chain-of-custody log as it goes. You walk away with a ZIP where every file is hashed and accounted for.
- Single binary, no runtime dependencies
- Intel + Apple Silicon
- macOS 12 Monterey and later
- SHA-256 on every file
- 14:02:07Collection started
- 14:02:09shell.history collectedsha256 ✓
- 14:02:14browser.safari collectedsha256 ✓
- 14:02:20system.users collectedsha256 ✓
- 14:03:41system.unifiedlogs collectedsha256 ✓
- 14:04:02filesystem.fsevents collectedsha256 ✓
- 14:04:19Manifest, custody log and hashes written
A case is only as defensible as its collection.
Analysis can be redone. Collection can't. Collector is built so the first step is the one nobody can pick apart later.
Custody written as it runs
Ad-hoc copy scripts leave no record of what was taken, when, or how. Collector writes a timestamped chain-of-custody log and a manifest alongside the evidence — every time.
Nothing to install on the subject
One static Go binary with no runtime dependencies. No Python, no Homebrew, no package manager touching the machine you're examining. Copy it on, run it, take it off.
Open format, no lock-in
Evidence ships as a plain ZIP with a readable manifest and SHA-256 hashes. Any tool can open it, opposing experts can verify it, and it stays yours whether or not you ever pay us.
From triage to handover in three steps.
No agent, no server, no account. Just the binary and the Mac in front of you.
- 01
Download and verify
Pull the release binary and check its published SHA-256 before it goes anywhere near the case.
- 02
Dry-run, then collect
See what will be collected before you commit. Then collect everything, or a single plugin. Run with sudo and Full Disk Access to reach every user account.
- 03
Hand over one container
Artifacts, manifest, hashes and custody log in a single ZIP — ready for your analysis tools, your SIEM, or the other side's expert.
The evidence container
Open the ZIP. Everything you'll be asked about is already there.
- Collection manifest
- What was collected, from where, by which plugin.
- SHA-256 for every file
- Hashed at the point of collection, so integrity can be proven at any later stage.
- Chain-of-custody log
- A timestamped record of every action the collector took.
├── manifest.json ├── chain-of-custody.json ├── hashes.json ├── artifacts/ # raw files, by plugin and user ├── records/ # parsed records, JSONL └── logs/ # per-plugin collection logs
The artifacts that answer “what happened on this Mac?”
Full artifact referenceShell history
What was typed, by which user.
- Bash, Zsh, Fish, ShCommunity
User accounts
Whose machine, which accounts.
- Local accounts, including hidden and service accountsCommunity
Browsers
History, downloads and sessions.
- SafariCommunity
- Chrome, Firefox, ArcProfessional
System logs
The timeline the OS kept for you.
- Unified LogsProfessional
- FSEventsProfessional
- Spotlight metadataProfessional
User activity
What they opened, ran and kept running.
- Quick Look thumbnailsProfessional
- KnowledgeC and Biome activityProfessional
- Launch agents and login itemsProfessional
- Screen Time usageProfessional
Questions examiners ask first
Is the free edition actually usable for casework?
Yes. Community includes shell history, Safari and local user accounts, with the same hashing, manifest and custody log as Professional.
Which Macs does it run on?
Intel and Apple Silicon, macOS 12 Monterey and later. It's one binary with no runtime dependencies.
Can I see what it will collect before it runs?
Run a dry run first. You can also target a single plugin instead of collecting everything.
Do I need root?
Run it with sudo to read other users' home directories, and give your terminal Full Disk Access so macOS doesn't block protected data. macfor warns you if Full Disk Access is missing.
What happens to my evidence if I stop paying?
Nothing. Containers use open formats, so everything you've collected stays readable and verifiable.
Where's the source?
On GitHub at github.com/macfor-io/macfor-community, under the MIT license, so you can read it, audit it and cite it in your methodology.
Your next Mac case starts with one command.
Install with Homebrew on your workstation, or download the binary from GitHub and verify the hash. Free and open source.