Mac OS tools

Name	From	Description
Audit	Twocanoes Software	Audit Preference Pane and Log Reader for OS X
ChainBreaker	Kyeongsik Lee	Parses keychain structure, extracting user’s confidential information such as application account/password, encrypted volume password (e.g. filevault), etc
Disk Arbitrator	Aaron Burghardt	Blocks the mounting of file systems, complimenting a write blocker in disabling disk arbitration
Epoch Converter*	Blackbag Technologies	Converts epoch times to local time and UTC
FTK Imager CLI for Mac OS*	AccessData	Command line Mac OS version of AccessData’s FTK Imager
IORegInfo	Blackbag Technologies	Lists items connected to the computer (e.g., SATA, USB and FireWire Drives, software RAID sets). Can locate partition information, including sizes, types, and the bus to which the device is connected
Mac Memory Reader	Cyber Marshal	Command-line utility to capture physical RAM from Mac OS systems
PMAP Info*	Blackbag Technologies	Displays the physical partitioning of the specified device. Can be used to map out all the drive information, accounting for all used sectors
Volafox	Kyeongsik Lee	Memory forensic toolkit for Mac OS X