# ydkhatri/mac_apt

macOS (& ios) Artifact Parsing Tool

Repository: https://github.com/ydkhatri/mac_apt
Canonical: https://ross.abutalabs.com/products/mac_apt
Homepage: https://swiftforensics.com
Language: Python
License: MIT
License Family: permissive
Topics: dfir, forensics, macos
Last push: 2026-08-21T23:27:52+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 81, longevity 100
- inputs: {"age_days": 3296, "days_push": 12, "days_rel": 44, "gap_med": 38, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1077, forks 128 (observed 2026-08-28T04:03:29.735275+00:00)

## What it is
mac_apt is a Python-based DFIR framework that parses macOS and iOS disk images or live systems to extract forensic artifacts like Safari history, network configuration, and recently accessed files. It uses a plugin architecture, supports many image formats (E01, DMG, AFF4, DD, UAC collections), and outputs to XLSX, CSV, TSV, JSONL, or SQLite.

## Use cases
- parse artifacts from a macOS full disk image for a forensic investigation
- extract Safari browsing history and recent files from a Mac evidence image
- perform live response triage on a running Mac
- process an iOS or GrayKey extraction and parse app and system artifacts
- read APFS or HFS images including encrypted volumes with a recovery key
- ingest UAC or Velociraptor collections and export artifacts to CSV or SQLite
- parse Spotlight, ASL logs, and Bluetooth data from a Mac image

## When to choose
- you need a free, scriptable, cross-platform tool for macOS/iOS forensic artifact extraction
- you want a plugin framework you can extend with custom artifact parsers
- you need to process many image formats including E01, AFF4, DMG, and UAC/Velociraptor collections
- you prefer command-line, repeatable processing with structured outputs like JSONL or SQLite

## When to avoid
- you need a GUI-driven forensic suite with timeline and bookmarking features
- your target is Windows or Linux artifacts rather than macOS/iOS
- you need commercial support or court-validated tooling with vendor certification
- you require a Python version below 3.10 or a 32-bit environment

## Facets
- artifact type: framework
- maturity: stable
- function: parser, developer-tools, security, data-science
- domain: security, operating-systems, apple-ecosystem
- platform: python, windows, cross-platform, cli
- tags: dfir, digital-forensics, incident-response, macos-forensics, ios-forensics, artifact-parsing, apfs, hfs, disk-images, live-response, plugin-framework, forensics, macos, linux

## Member repositories
- ydkhatri/mac_apt (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:29.735275+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:53:18.282706+00:00, confidence not recorded.
  - readme: https://github.com/ydkhatri/mac_apt (fetched 2026-08-28T04:03:29.735275+00:00, sha 1643f029e924)
  - homepage: https://swiftforensics.com (fetched 2026-08-29T12:54:56.831722+00:00, sha 64373867b8c5)
  - site_page: https://www.swiftforensics.com/p/about.html (fetched 2026-08-29T12:54:56.841657+00:00, sha 726a8be10b22)
- Data as of 2026-08-30T08:39:29.467469+00:00.