ydkhatri/mac_apt
Some data may be outdated — see provenance labels.
macOS (& ios) Artifact Parsing Tool observed · 2026-10-04
Health v2 · maintenance only
90/100
- Activity 98
- Release rhythm 74
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-21. Adoption (stars, forks) is never an input.
- gap_med: 38
- age_days: 3344
- days_rel: 92
- days_push: 17
- n_releases_24m: 8
Adoption not part of the score
1088 stars · 126 forks observed · 2026-10-04
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
mac_apt is a Python-based DFIR framework that parses macOS and iOS disk images or live systems to extract forensic artifacts like Safari history, network configuration, and recently accessed files. It uses a plugin architecture, supports many image formats (E01, DMG, AFF4, DD, UAC collections), and outputs to XLSX, CSV, TSV, JSONL, or SQLite.
Use cases
- parse artifacts from a macOS full disk image for a forensic investigation
- extract Safari browsing history and recent files from a Mac evidence image
- perform live response triage on a running Mac
- process an iOS or GrayKey extraction and parse app and system artifacts
- read APFS or HFS images including encrypted volumes with a recovery key
- ingest UAC or Velociraptor collections and export artifacts to CSV or SQLite
- parse Spotlight, ASL logs, and Bluetooth data from a Mac image
When to choose
- you need a free, scriptable, cross-platform tool for macOS/iOS forensic artifact extraction
- you want a plugin framework you can extend with custom artifact parsers
- you need to process many image formats including E01, AFF4, DMG, and UAC/Velociraptor collections
- you prefer command-line, repeatable processing with structured outputs like JSONL or SQLite
When to avoid
- you need a GUI-driven forensic suite with timeline and bookmarking features
- your target is Windows or Linux artifacts rather than macOS/iOS
- you need commercial support or court-validated tooling with vendor certification
- you require a Python version below 3.10 or a 32-bit environment
Facets
framework · maturity stable
parser developer-tools security data-science security operating-systems apple-ecosystem python windows cross-platform cli dfir digital-forensics incident-response macos-forensics ios-forensics artifact-parsing apfs hfs disk-images live-response plugin-framework forensics macos linux
3 sources
- readme: https://github.com/ydkhatri/mac_apt · fetched 2026-10-04 · 1643f029e924
- homepage: https://swiftforensics.com · fetched 2026-08-29 · 64373867b8c5
- site_page: https://www.swiftforensics.com/p/about.html · fetched 2026-08-29 · 726a8be10b22
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| ydkhatri/mac_apt | main | 90 |
For agents
markdown · JSON · MCP: product_card(name="ydkhatri/mac_apt")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem