Product
Product Comparison
Compare macfor editions and find the right fit for your forensic needs.
Edition Comparison
Choose the macfor edition that fits your needs. All editions include forensically sound collection methodology, evidence containers with hash verification, and chain of custody documentation.
Collector
| Feature | Community Free MIT open source | Professional $169/user/mo Commercial | Enterprise $339/user/mo Commercial |
|---|---|---|---|
| Shell artifacts | |||
Bash history | |||
Zsh history | |||
Fish history | |||
| Browser artifacts | |||
Safari | |||
Chrome | |||
Firefox | |||
Edge | |||
Brave | |||
| System artifacts | |||
Unified Logs tracev3 native parser | |||
FSEvents | |||
Spotlight metadata | |||
Keychain metadata | |||
| Output formats | |||
Evidence container (ZIP) | |||
JSONL records | |||
Raw file preservation | |||
| Features | |||
Multi-user collection | |||
Dry-run mode | |||
JSON output | |||
Custom plugins | |||
| Support | |||
Community (GitHub) | |||
Email support | |||
Dedicated Slack | |||
SLA | |||
macfor Analyze
| Feature | Professional Included | Enterprise Included |
|---|---|---|
| Analysis | ||
Artifact import | ||
Unified timeline | ||
Graph visualisation | ||
Cross-browser correlation | ||
| Collaboration | ||
Investigation workspaces | 5 | Unlimited |
Team members | 5 | Unlimited |
| Reporting | ||
PDF reports | ||
Custom templates | ||
API access | ||
Which edition is right for you?
Community
Individual practitioners and researchers, learners getting into macOS forensics, teams evaluating macfor before purchasing, and open-source contributors.
Professional
Forensic consultants and small teams, incident response and internal investigation departments, and organisations with Mac fleets needing full artifact coverage.
Enterprise
Large forensic practices and MSSPs, organisations with compliance requirements, teams needing custom artifact collection, and high-volume investigation workflows.
Frequently asked questions
Can I upgrade from Community to Professional?
Yes — you can upgrade at any time. Your existing evidence containers remain fully compatible.
Is there a trial period?
Professional and Enterprise editions include a 14-day free trial with full functionality.
What about disk image support?
All editions support both live system collection and disk image analysis. Disk images need to be mounted before collection.
Do you offer academic discounts?
Yes — we offer 50% discounts for academic institutions. Contact us for details.