Mac Forensics

소개

This tool serves as an MCP server designed to streamline macOS Digital Forensics and Incident Response (DFIR) investigations. It offers structured forensic analysis capabilities for macOS triage collections, significantly reducing the contextual overhead typically encountered when using large language models (LLMs). With 23 specialized tools, it facilitates the analysis of Unified Logs, FSEvents, Spotlight, Plists, SQLite databases, Extended Attributes, and System Logs, enhancing the speed and accuracy of incident investigations.

주요 기능

• Structured queries for forensic artifacts, avoiding raw file grepping
• Cross-artifact correlation and timeline building for comprehensive views
• Automatic timestamp normalization (Mac Absolute Time to UTC)
• Artifact discovery to identify available data in triage collections
• 1 GitHub stars
• Pre-built security event detection patterns (e.g., user creation, SSH sessions)

사용 사례

• Investigate user account activities, including creation, deletion, and timelines
• Discover available artifacts within a macOS forensic triage collection
• Identify security events like SSH sessions, sudo usage, and authentication attempts