mac_apt
mac_apt is a versatile DFIR tool for processing Mac and iOS images, offering extensive artifact extraction capabilities and cross-platform support.
mac_apt is a versatile DFIR tool for processing Mac and iOS images, offering extensive artifact extraction capabilities and cross-platform support.
Checked November 2026.
mac_apt is a DFIR (Digital Forensics and Incident Response) tool designed to process Mac computer full disk images or live machines, extracting data and metadata crucial for forensic investigations. It is a Python-based framework with plugins for processing various artifacts like Safari internet history, network interfaces, and recently accessed files.
Additionally, mac_apt now includes ios_apt for handling iOS images. It is cross-platform, supports multiple image formats, provides outputs in XLSX, CSV, TSV, and SQLite, and can handle compressed files. The tool also features native HFS and APFS parsing, reads Spotlight database and Unified Logging files, and supports macOS Big Sur sealed volumes.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about mac_apt: features, pricing and alternatives.
mac_apt is a product in the Digital Forensics category. It covers macOS.
mac_apt is free. Download and setup instructions are at https://github.com/ydkhatri/mac_apt/.
Alternatives to mac_apt listed on CybersecTools:
Compare all mac_apt alternatives at https://cybersectools.com/alternatives/macapt
mac_apt is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A tool for advanced HTTPD logfile security analysis and forensics, implementing various techniques to detect attacks against web applications.
Toolkit for performing acquisitions on iOS devices with logical and filesystem acquisition support.
A digital forensics tool that extracts and exports location database contents from iOS and macOS devices in KML or CSV formats.
A collection of Mac OS X and iOS forensics resources with a focus on artifact collection and collaboration.
Python script to parse macOS MRU plist files into human-friendly format
A tool for recovering files by scanning block devices and extracting them based on 'magic bytes' in file contents.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,032 products.
Connect your AI
