Start open source. Scale when the casework does.
Every edition collects the same way: forensically sound, hash-verified, with chain-of-custody records. What changes is how much of the Mac you reach, and the help that comes with it.
macfor Collector
Every artifact, edition by edition.
In development
Analyze is included with Professional and Enterprise.
When it launches, macfor Analyze is included with every Professional and Enterprise Collector licence. Import your evidence containers, then explore, search and report on them.
See what Analyze does| ANALYZE | Professional | Enterprise |
|---|---|---|
| Hash-verified evidence import | ||
| Cross-source timeline | ||
| Semantic search | ||
| Evidence-citing assistant | ||
| Findings and IOCs | ||
| Report builder | ||
| Cases | Unlimited | Unlimited |
| Graph view | Planned | Planned |
| Team workspaces | Planned | Planned |
| REST API access |
Before you choose
Can I upgrade from Community later?
Any time. Evidence containers you've already collected stay compatible.
Do all editions handle disk images?
Yes. Every edition supports live collection and mounted disk images. Mount the image, then point the collector at it.
Does my evidence depend on the edition?
No. Every edition writes the same open container format, so your evidence stays readable and verifiable whichever edition you use next.
Which Macs does it run on?
Intel and Apple Silicon, macOS 12 Monterey and later, in every edition.
Start with the open-source Collector.
Install Community with Homebrew and run your first collection. Your evidence containers stay compatible as your casework grows.