---

Mac Research

Free Alternatives to FOR518: Mac and iOS Forensic Analysis and Incident Response

A general note: mac4n6.com/resources (Sarah Edwards' own site) is itself a free index of nearly all her SANS DFIR Summit, DEFCON, and BSides talks in PDF/video form, and touches most sections below. It's worth bookmarking on its own: http://www.mac4n6.com/resources

---

Apple Device Essentials, Security Architecture, and Disks/Volumes

• Apple Platform Security Guide — Apple's own comprehensive technical reference on Secure Enclave, Data Protection classes, T2 chip, Apple Silicon boot chain, and FileVault internals. The single best primary source for how Apple's security stack actually works under the hood.
• SWGDE Best Practices for Apple macOS Forensic Acquisition — Working-group standard covering disk/volume acquisition considerations across Intel T2 and Apple Silicon Macs, including FileVault and Secure Enclave implications.
• SUMURI: Imaging Apple Silicon Macs — A Modern Forensic Guide — Practical walkthrough of the modern Apple Silicon security architecture and how it changes disk-imaging strategy versus older Intel Macs.
• SUMURI: Why APFS Snapshots Change Everything in Mac Forensics — Explains APFS snapshots/volumes as they relate to acquisition and evidence preservation.

macOS Acquisition Tools and Methods

• SWGDE Best Practices Apple macOS Forensic Acquisition (PDF) — Vendor-neutral acquisition methodology (live vs. dead, target disk mode successor "Mac Share Disk," FileVault-unlocked volumes).
• Forensic Focus: From FileVault to T2 — How to Deal with Native Apple Encryption — Free article walking through the practical obstacles T2/FileVault present during acquisition and how examiners work around them.
• Elite Digital Forensics: MacBook Forensics (2026) — Up-to-date free rundown of realistic 2026-era acquisition options (sparse image collection, live triage, Share Disk) now that full raw imaging is largely blocked on Apple Silicon.

iOS Acquisition Tools and Methods

• SANS Blog: iOS Full File System Extraction Using Checkra1n and iOS BFU Triage Script (Part 1) — Free walkthrough from SANS itself on jailbreak-based (checkm8/checkra1n) full filesystem extraction.
• RealityNet/ios_bfu_triage (GitHub) — Free, open-source tool for triaging a Before-First-Unlock iOS device once checkra1n access is obtained.
• RealityNet/iOS-Forensics-References (GitHub) — Large curated bibliography of free iOS forensic research papers, talks, and tools, continuously updated.
• ElcomSoft Blog: iOS Forensic Toolkit / checkm8 tag archive — Ongoing free technical write-ups on checkm8-based extraction techniques and device coverage.

Data Organization, Triage, and iCloud Forensics

• Forensic Focus: Evidence Acquisition and Analysis from iCloud — Free article on obtaining iCloud data via authentication tokens rather than credentials, and what is/isn't end-to-end encrypted.
• ElcomSoft Blog: Cloud Forensics — Obtaining iCloud Backups, Media Files and Synchronized Data — Practical breakdown of what's recoverable from iCloud (backups vs. sync data vs. end-to-end encrypted categories like Keychain/Health/Messages).
• ElcomSoft Blog: Apple iCloud Acquisition — A Lifeline for Forensic Experts — Covers 2FA/token-based acquisition workflow and common pitfalls.
• Sarah Edwards — Ubiquity Forensics: Your iCloud and You (DEFCON 23 / SANS DFIR Summit 2015) — Free talk (slides also on mac4n6 GitHub) specifically on iCloud artifact analysis, still broadly relevant for understanding Apple's sync architecture.

macOS Unified Logging (Log Analysis)

• LOGS UNITE! Forensic Analysis of Apple Unified Logs (PDF) — Sarah Edwards' own research paper reverse-engineering the Unified Log tracev3/uuidtext format; the foundational free document on this artifact.
• Mandiant/Google: macos-unifiedlogs (GitHub) — Free, open-source Rust parser for tracev3/uuidtext files, works offline on logarchive collections without needing a live Mac.
• Google Cloud Blog: Reviewing macOS Unified Logs — Incident-response-focused walkthrough of using Unified Logs during an investigation, including gaps and anti-forensics considerations.
• CrowdStrike: How to Leverage Apple Unified Log (AUL) for IR — Free blog covering practical log show/log collect usage and useful predicates for IR.
• Sarah Edwards — Analysis and Correlation of Mac Logs (SANS DFIR Webcast, 2013/2016) — Older but free foundational talk on correlating macOS logs for timeline work.

User Account, Network, and Bluetooth Artifacts

• mac_apt — macOS (& iOS) Artifact Parsing Tool (GitHub) — Free, actively maintained Python framework (by Yogesh Khatri) with plugins for user accounts, network interfaces, recents, Bluetooth, Spotlight, and more — a practical hands-on substitute for a large chunk of the course labs.
• ahmed86-star: macOS Forensics Artifacts (blog) — Free reference listing key plist/database locations for user accounts, network config, and device connection history.
• jjarava/mac-osx-forensics (GitHub) — Free scripts for pulling plist-based artifacts (network, Bluetooth, recents) directly from a mounted image or live system.
• Apple Forensics: Geolocation with Network Data (Medium) — Free write-up on Wi-Fi/network artifacts used to establish device geolocation history.

APFS (Apple File System) Internals

• Decoding the APFS File System (Digital Investigation journal, free PDF via ResearchGate) — The original academic paper reverse-engineering APFS structures, co-authored with input from APFS's chief architect.
• ERNW Whitepaper 65: APFS Internals for Forensic Analysis (PDF) — Free, detailed technical whitepaper on APFS on-disk structures aimed squarely at forensic examiners.
• Revisiting Data Hiding Techniques for Apple File System (PDF) — Academic paper on deleted-file recovery and anti-forensic data-hiding techniques specific to APFS.
• Sarah Edwards — Getting Saucy with APFS (BSidesCharm 2018) — Free talk covering APFS structure fundamentals plus how to mount APFS images on SIFT/Linux and macOS.
• Magnet Forensics: White Paper — Magnet AXIOM and macOS/APFS — Free vendor whitepaper summarizing APFS features most relevant to examiners (clones, snapshots, encryption).

Extended Attributes (xattr) and Quarantine

• dfir.ch: macOS Extended Attributes — Case Study — Free deep-dive blog post on xattr forensic value, including com.apple.quarantine and com.apple.metadata:kMDItemWhereFroms.
• kieczkowska/xattribs (GitHub) — Free open-source tool purpose-built for forensic extraction of extended attributes and the LSQuarantineEventsV2 database (AirDrop/browser downloads).
• HackMD: Extended Attributes macOS Forensics — Free condensed notes on xattr structure and common forensic namespaces.
• The Eclectic Light Company: Quarantine, MACL and provenance — what are they up to? — Free, currently-updated explainer on the quarantine flag, provenance attributes, and MACL (Mandatory Access Control Labels) on modern macOS.

Spotlight Forensics

• Investigating Spotlight Internals to Extract Metadata (Yogesh Khatri, Digital Investigation) — Free companion blog post to the peer-reviewed paper; explains store.db internals and metadata recovery.
• ydkhatri/spotlight_parser (GitHub) — Free, open-source Python parser for the Spotlight store.db format (also bundled as a plugin in mac_apt).
• Swift Forensics: The User Spotlight Database — Free follow-up post covering the per-user CoreSpotlight index, distinct from the volume-level store.db.
• Sarah Edwards — OS X Spotlight Queries (slides, mac4n6 GitHub) — Free slide deck of practical mdfind/metadata attribute queries useful for investigations.

Document Versions and Metadata

• Apple Developer: File System Programming Guide — Document Versions — Apple's own reference on how the Versions/auto-save database (Versions.db and /.DocumentRevisions-V100) works, useful background before examining artifact output.
• SUMURI: Mac File Activity Forensics — FSEvents, Spotlight, .DS_Store, APFS — Free overview that folds document-versioning artifacts in with the other file-activity metadata stores covered in this section of the course.

FSEvents (File System Events Store Database)

• Hexordia: FSEvents — How They Work and Why They Matter for Mac Analysis — Free, clear explainer of FSEvents internals and forensic use cases (e.g., proving prior existence of deleted/malicious files).
• dlcowen/FSEventsParser (GitHub) and the maintained fork mac4n6/FSEventsParser — Free open-source Python parsers for fseventsd log streams, including the newer "3SLD" record format.
• puffyCid/macos-fseventsd (GitHub) — Free, actively maintained Rust library/parser for FSEvents, useful if you want a modern alternative implementation.
• Sarah Edwards — Mac Forensics: Looking into the Past with FSEvents (SANS DFIR Summit 2017) — Free recorded conference talk covering FSEvents forensic methodology end-to-end.

Mach-O Executable Analysis

• Wikibooks: Reverse Engineering/Mac OS X — Free, open community-maintained primer on the Mach-O universal binary format and reversing techniques on macOS.
• michalmalik/osx-re-101 (GitHub) — Free curated collection of articles/papers on Mach-O internals, Objective-C runtime, and OS X/iOS reverse engineering more broadly.
• The Art of Mac Malware, Vol. 1: Analysis (free to read online) — Patrick Wardle's full book, readable free chapter-by-chapter, includes detailed Mach-O parsing, unpacking, and static-analysis content directly relevant to this topic.
• MachOView (GitHub) — Free open-source GUI tool for visually inspecting Mach-O headers, load commands, and segments.

Safari (and Browser) Forensics

• Digital Detective: Forensic Analysis of Apple Safari Web Browser — Free deep technical reference on Safari's history, cache, and cookie storage formats.
• Digital Detective Knowledge Base: Apple Safari Analysis — Companion free KB article detailing each Safari artifact file and its schema.
• Infosec Institute: Browser Forensics — Safari — Free tutorial-style walkthrough of manually parsing Safari's History.db and binary cookies.
• Cyberengage: Analyzing Safari Browser, Apple Mail Data and Recents Database Artifacts on macOS — Free, current (2024/25-era) practical walkthrough bundling Safari with Mail and Recents artifacts, mirroring this section of the course closely.

Messaging and Calling Artifacts (iMessage, FaceTime, Mail)

• MAC OS Sequoia: SMS and iMessage Service Forensics (ResearchGate, free PDF) — Recent (2025) academic paper on chat.db structure and message/timeline reconstruction on the current macOS.
• MAC OSX: iMessage, FaceTime, Apple Mail Application Forensics (ResearchGate, free PDF) — Earlier academic paper covering the same three native communication apps together.
• Belkasoft: Lagging for the Win — Querying for Negative Evidence in the sms.db — Free article on advanced SQL querying against sms.db/chat.db, including inferring evidence of deletion.
• niftycode/imessage_reader (GitHub) — Free open-source Python tool to extract messages, handles, and attachments straight from chat.db.

Notes, Photos, and Maps Analysis

• ScottKjr3347/iOS_Local_PL_Photos.sqlite_Queries (GitHub) — Free, actively documented set of SQL queries for both the iOS and macOS Photos.sqlite schema, built from community research.
• The Forensic Scooter: Photos.sqlite category archive — Free ongoing research blog by Scott Koenig dedicated entirely to reverse-engineering the Photos.sqlite schema across iOS/macOS versions.
• Smarter Forensics: Does Photos.sqlite Have Relations with Camera/Messages App? — Free article on cross-referencing Photos data with other app artifacts (provenance of images).
• #DFIRFIT or BUST: A Forensic Exploration of iOS Health Data (Sarah Edwards, SANS DFIR Summit 2018) — While focused on Health rather than Notes/Maps, this is the closest free mac4n6 talk on parsing a similarly structured native-app SQLite database end-to-end and is a good methodology template.

Pattern-of-Life Analysis (APOLLO)

• mac4n6/APOLLO (GitHub) — The actual free, open-source tool used in the course (Apple Pattern of Life Lazy Output'er), created by the course author herself.
• Go For Launch: Getting Started with Practical APOLLO Analysis (OSDFCon 2020, free video) — Free recorded conference session walking through hands-on APOLLO usage.
• Exploring macOS with APOLLO (Objective by the Sea 3.0, free video) — Full 1h44m free conference talk applying APOLLO specifically to macOS pattern-of-life artifacts.
• Cyber Forensicator: Apple Pattern of Life Lazy Output'er (APOLLO) — Free write-up explaining the concept and module structure behind APOLLO for those wanting the theory before the tool.

Password Cracking (Keychain, FileVault, User Accounts)

• n0fate/chainbreaker (GitHub) — Free open-source macOS keychain forensic tool; extracts hashes suitable for hashcat/John the Ripper and can decrypt with a known password, master key, or SystemKey file.
• Embrace The Red: Grabbing and Cracking macOS Hashes — Free walkthrough of extracting local account password hashes from /var/db/dslocal and cracking with hashcat mode 7100/keychain mode 23100.
• hashcat (open-source tool) — Free password-recovery engine with built-in support for macOS keychain and user-account hash formats.
• macmade/KeychainCracker (GitHub) — Free, purpose-built brute-forcer specifically for macOS keychain files.

macOS Malware Analysis and Firewall Artifacts

• The Art of Mac Malware, Vol. 1: Analysis — free online and Vol. 2: Detection — free online — Patrick Wardle's complete two-volume book series, readable in full for free; covers infection vectors, persistence, unpacking, and building detection heuristics for Mac malware specifically.
• Objective-See Foundation — Free open-source macOS security tools (e.g., BlockBlock, KnockKnock, LuLu firewall) plus Patrick Wardle's malware research write-ups, useful for understanding both offense and the firewall/persistence artifacts examiners look for.
• Objective by the Sea talks archive — Free videos/slides from the dedicated Apple security conference; strong ongoing coverage of current macOS malware campaigns and persistence techniques.
• Sarah Edwards — Reverse Engineering Mac Malware (SANS DFIR Webcast) — Free foundational talk connecting malware reversing directly to the forensic-artifact side of an investigation.

Other Apple Technologies (Find My, AirTags, Time Machine, Apple Watch, HomeKit)

• Adam Catley: Apple AirTag Reverse Engineering — Free, continually referenced technical hub on AirTag/Find My internals, hardware, and protocol reverse engineering.
• OpenHaystack project research on the Find My network — Free open-source research project (from the team that first reverse-engineered Apple's offline-finding protocol) with accompanying papers on Find My privacy/security.
• The Binary Hick: Where the Wild Tags Are & Other AirTag Stories — Free, forensics-examiner-focused (not just security-research) blog post on AirTag artifacts as they show up in an actual case.
• Sarah Edwards — Apple Watch Preview: Time's a Tickin' (slides, mac4n6 GitHub) — Free early but still-relevant deep dive into Apple Watch forensic artifacts and pairing data.
• SUMURI: Why APFS Snapshots Change Everything in Mac Forensics (also listed above) — Directly relevant to Time Machine's modern local-snapshot behavior on APFS.
• mnrkbys/macosac (GitHub) — Free, open-source artifact collection tool that explicitly supports pulling artifacts out of Time Machine backups as well as the live disk.
• Sarah Edwards — What's Behind the Apple Magic, Forensically Speaking (Sikkerhetsfestivalen 2024, PDF) — The most recent (2024) mac4n6 talk, broadly covering newer cross-device Apple ecosystem artifacts in the same spirit as the course's "Other Apple Technology" material (Find My, Watch, HomeKit-adjacent continuity features).