- Joined
- May 15, 2017
- Messages
- 982
- Likes
- 760
- Points
- 1,045
![osxcollector_1_osx-github.png](https://1.bp.blogspot.com/-nTYtnVrWQ7E/XTT0r4VRfUI/AAAAAAAAPrE/jQ7H-N0UkEY7BySUl4kDy4JG4wjgBhrjwCLcBGAs/s640/osxcollector_1_osx-github.png)
OSXCollector is a forensic evidence collection & analysis toolkit for OSX.
Forensic Collection
The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases and the local file system.
Forensic Analysis
Armed with the forensic collection, an analyst can answer the question like:
- Is this machine infected?
- How'd that malware get there?
- How can I prevent and detect further infection?
Performing Collection
osxcollector.py is a single Python file that runs without any dependencies on a standard OSX machine. This makes it really easy to run collection on any machine - no fussing with brew, pip, config files, or environment variables. Just copy the single file onto the machine and run it:
Code:
sudo osxcollector.py
is all it takes.
Download Osxcollector