Mac OS tools

Mac OS tools




Audit Twocanoes Software Audit Preference Pane and Log Reader for OS X
ChainBreaker Kyeongsik Lee Parses keychain structure, extracting user’s confidential information such as application account/password, encrypted volume password (e.g. filevault), etc
Disk Arbitrator Aaron Burghardt Blocks the mounting of file systems, complimenting a write blocker in disabling disk arbitration
Epoch Converter* Blackbag Technologies Converts epoch times to local time and UTC
FTK Imager CLI for Mac OS* AccessData Command line Mac OS version of AccessData’s FTK Imager
IORegInfo Blackbag Technologies Lists items connected to the computer (e.g., SATA, USB and FireWire Drives, software RAID sets). Can locate partition information, including sizes, types, and the bus to which the device is connected
Mac Memory Reader Cyber Marshal Command-line utility to capture physical RAM from Mac OS systems
PMAP Info* Blackbag Technologies Displays the physical partitioning of the specified device. Can be used to map out all the drive information, accounting for all used sectors
Volafox Kyeongsik Lee Memory forensic toolkit for Mac OS X

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.