macos-collector

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily Aftermath by Jamf Threat Labs.

Download

Download the latest version of macos-collector from the Releases section.

Note

macos-collector includes all external tools by default.

Note

Default Archive Password: IncidentResponse

Note

Quarantine Files Password: infected

Tip

By default, macos-collector will write the output directly to the current working directory. It is recommended to run the tool from a remote location or external device (such as a USB flash drive) to reduce writing to the actual disk on the target endpoint.

Important

Aftermath needs to be root, as well as have full disk access (FDA) in order to run. FDA can be granted to the Terminal application in which it is running.

To give your Terminal application temporarily full disk access, go to System Settings → Privacy & Security → Full Disk Access, click the + button, unlock the settings with Touch ID or enter your password, and choose your Terminal application. You will then need to quit and reopen your Terminal application for the changes to take effect. To revoke the access, simply return to the same menu and uncheck your Terminal application.

Usage

sudo bash macos-collector.sh [OPTION] [--output-path PATH]

Example 1 - Collect forensic artifacts from a compromised macOS endpoint using Aftermath

sudo bash macos-collector.sh --collect  

Example 2 - Analyze previous collected Aftermath archive file

sudo bash macos-collector.sh --analyze

Example 3 - Collect FSEvents Data from a compromised macOS endpoint

sudo bash macos-collector.sh --fsevents  

Example 4 - Collect ALL supported macOS Forensic Artifacts

sudo bash macos-collector.sh --triage --output-path "/Volumes/T9/"    

Example 5 - Collect Forensic Artifacts w/ UAC (Unix-like Artifacts Collector)

sudo bash macos-collector.sh --uac --output-path "/Users/<user>/Desktop/"  

Fig 1: Help Message

Fig 2: Aftermath Collection w/ Deep Scan

Fig 3: Analyzing Aftermath Archive → switch to a clean macOS endpoint

Fig 4: Collecting BTM Dump File (Background Task Management)

Fig 5: Collecting DS_Store Files

Fig 6: Collecting FSEvents Data

Fig 7: Live System Scan w/ KnockKnock (Persistence)

Fig 8: Collecting Apple Unified Logs (AUL)

Fig 9: Collecting Sysdiagnose Logs

Fig 10: Spotlight Database File Collection (incl. Live Searches)

Fig 11: System Information Collection → XProtect is up to date

Fig 12: System Information Collection → XProtect Update available

Fig 13: Recent Items Collection

Fig 14: TrueTree Snapshot Collection (incl. General Process Information)

Fig 15: Notification Center Database File Collection

Fig 16: Biome Data Collection (incl. Biome Timeline)

Fig 17: Unix-like Artifacts Collector (UAC)

Dependencies

7-Zip v26.02 Console Version (2026-06-25)
MD5: CBBA6B6C2F2C37EAEE2167BF847570BB
SHA1: 6BACAAB15E4E1A1048066589FFC9892EFEEDFF2C
SHA256: 9C56CF3379A0D8544E9244958B96FDC7C17F9CE70F5A160EB2B41F5F3DF96D8C
https://www.7-zip.org/download.html

Aftermath v2.3.0 (2025-09-24)
MD5: A0668EB91650513F40CE8753A277E0E0
SHA1: 782077A3FE5351C72157142C437EA5D20BEF00E9
SHA256: A58489ACC3E3BB7D5BC70B66DFF5897CBF93BFE38E66C119C4FF1013559D912A
https://github.com/jamf/aftermath

KnockKnock v4.0.3 (2025-12-18)
MD5: 91582848022442C8A6D71ED28A10A11B
SHA1: FDAEB856E44563E7C543F775A238D590A3A4B2EC
SHA256: A7836AF427187D02511170606232E4509C3A41351F5BBC3BAFAFE2F0227CC2DE
https://objective-see.com/products/knockknock.html

TrueTree v0.8 (2024-08-23)
MD5: 7D4ACAA589846B9D31FBC911D1E4898F SHA1: BF701DABCFBD816425FB827B75B011773D9283AD SHA256: C6CE708937EFAC833DA6A0B6F4FC1A91EB38F8D456317BCF68B27CF57CB581C6 https://github.com/themittenmac/TrueTree

UAC v3.3.0 (2026-04-15)
MD5: 89FA49B5903EA9EA230EBC7B2FC056DC
SHA1: FACDC04D6A04C0A59CA5E20553B41623EAFA2FC7
SHA256: 5BC89A49DE4274CCDBCA0728BE9F2B4FAF3709B3282D1F1644BC05B5E5A3C3B8
https://github.com/tclahr/uac

License

This project is licensed under the MIT License - see the LICENSE file for details.

Links

Aftermath by Jamf Threat Labs
Aftermath - SOAR Playbooks
TrueTree by Jaron Bradley
The Mitten Mac - Incident Response and Threat Hunting Knowledge for macOs
What Happened?: Swiftly Investigating macOS Security Incidents with Aftermath | JNUC 2023
KnockKnock - Persistence Enumerator by Objective-See
Biome Timeline by Mahmoud Swelam