Over the last several months, I've been developing a tool to process mac full disk images. It's an extendible framework (in python) which has plugins to parse different artifacts on a mac. The idea was to make a tool that an examiner could run as soon as a mac image was obtained to have artifacts parsed out in an automated fashion. And it had to be free and open-source, that ran on windows/linux (or mac) without the requirement of needing a mac to process mac images.
Here are the specifics:
- INPUT - E01 or dd image or DMG(not compressed)
- OUTPUT - Xlsx, Csv, Sqlite
- Parsed artifacts (files) are also exported for later manual review.
- lzvn compressed files (quite a few on recent OSX versions including key plist files) are supported too!
As of now, there are plugins to parse network information (ip, dhcp, interfaces), wifi hotspots, basic machine settings (timezone, hostname, HFS info, disk info,..), recent items (file, volume, applications,..) , local & domain user info, notifications, Safari history and Spotlight shortcuts. More are in the works.. Tested on OSX images from 10.9-10.12
The project is currently in alpha status. Let us know of bugs/issues, any feature requests, ..
The project is available on GitHub here.
Some motivations behind this project:
- Learn Python
- Learn more about OSX
Some motivations behind this project:
- Learn Python
- Learn more about OSX
Really interesting project, thanks for sharing! I looked at the code and I see that you are using pytsk3, is this the only thing needed to include EWF support?
ReplyDeleteYour post just gave me the idea of adding EWF support to RecuperaBit (which is also written in Python) and it looks like it might be feasible.