macOS Forensics

• FTk

• Cellebrite

• Sleuthkit

• mac-robber

• CelleBrite UFED

• iXAM

• Oxygen Forensic Suite 2010

• MacLock Pick

• Zdziarski Technique

• Paraben Device Seizure

• CellDEK

• EnCase Ncutrino

• ydkhatri/mac_apt: macOS (& ios) Artifact Parsing Tool

osxcollector

A forensic evidence collection & analysis toolkit for OS X

https://github.com/Yelp/osxcollector