ydkhatri/mac_apt

Health v2 · maintenance only

Adoption not part of the score

1077 stars · 128 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

mac_apt is a Python-based DFIR framework that parses macOS and iOS disk images or live systems to extract forensic artifacts like Safari history, network configuration, and recently accessed files. It uses a plugin architecture, supports many image formats (E01, DMG, AFF4, DD, UAC collections), and outputs to XLSX, CSV, TSV, JSONL, or SQLite.

Use cases

• parse artifacts from a macOS full disk image for a forensic investigation
• extract Safari browsing history and recent files from a Mac evidence image
• perform live response triage on a running Mac
• process an iOS or GrayKey extraction and parse app and system artifacts
• read APFS or HFS images including encrypted volumes with a recovery key
• ingest UAC or Velociraptor collections and export artifacts to CSV or SQLite
• parse Spotlight, ASL logs, and Bluetooth data from a Mac image

When to choose

• you need a free, scriptable, cross-platform tool for macOS/iOS forensic artifact extraction
• you want a plugin framework you can extend with custom artifact parsers
• you need to process many image formats including E01, AFF4, DMG, and UAC/Velociraptor collections
• you prefer command-line, repeatable processing with structured outputs like JSONL or SQLite

When to avoid

• you need a GUI-driven forensic suite with timeline and bookmarking features
• your target is Windows or Linux artifacts rather than macOS/iOS
• you need commercial support or court-validated tooling with vendor certification
• you require a Python version below 3.10 or a 32-bit environment

Facets

framework · maturity stable

parser developer-tools security data-science security operating-systems apple-ecosystem python windows cross-platform cli dfir digital-forensics incident-response macos-forensics ios-forensics artifact-parsing apfs hfs disk-images live-response plugin-framework forensics macos linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ydkhatri/mac_apt")