Files and Utilities to help you complete Apple Digital Analysis
Utilities
- MetaData Extractor - Application to extract metadata from files and map location data on Google Maps
- Dirty Mounter - Application to force mount a DMG that otherwise won't mount because of a corrupt file system or volume.
- Show Hidden Files - 2 Applescript apps to quickly turn on/off the Finder ability to see hidden files
- Trusted Utilities - Trusted Utilities Disk Image for Incident Response
- Spartan - 10.5 Application to Dictionary Attack "sparsebundle" and "sparseimage" files (crowbarDMG is much faster)
- Disk Arbitration Tools - Applescripts to turn Disk Arbitration on and off in 10.5 or later
- Epoch Time Convertor - A simple Applescript application to convert Epoch time to Calendar time (BBT offers a free tool that is much more complete)
Beta
- MacOSXForensics Imager - physical device imager, Encase and FTK formats supported
- FTK Imager for Mac GUI - this is the FTK Imager by AccessData with a Graphical User Interface added to it. It is in beta now. Please read the included notes before using. I welcome your feedback!
Documents
- Mac Forensics - Guide to Tiger Forensics
- Live Forensics Form - Examiner notes during Live Forensics
- Imaging Form - Examiner notes during imaging
- Examiner General Form - Examiner notes form for general use
See our Mac Forensic Software page for a list of recommended software from other sources.