# mac_apt

mac_apt is a Digital Forensics product. It runs on-premises. Pricing is free.

mac_apt is a versatile DFIR tool for processing Mac and iOS images, offering extensive artifact extraction capabilities and cross-platform support.

Checked November 2026.

## What is mac_apt?

mac_apt is a DFIR (Digital Forensics and Incident Response) tool designed to process Mac computer full disk images or live machines, extracting data and metadata crucial for forensic investigations. It is a Python-based framework with plugins for processing various artifacts like Safari internet history, network interfaces, and recently accessed files. Additionally, mac_apt now includes ios_apt for handling iOS images. It is cross-platform, supports multiple image formats, provides outputs in XLSX, CSV, TSV, and SQLite, and can handle compressed files. The tool also features native HFS and APFS parsing, reads Spotlight database and Unified Logging files, and supports macOS Big Sur sealed volumes.

Tags: macOS

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 923
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## mac_apt FAQ

### What is mac_apt?

mac_apt is a product in the Digital Forensics category. It covers macOS.

### What is the pricing for mac_apt?

mac_apt is free. Download and setup instructions are at https://github.com/ydkhatri/mac_apt/.

### What are alternatives to mac_apt?

Alternatives to mac_apt listed on CybersecTools:

1. [Cyber Triage Automated Investigation Platform](https://cybersectools.com/tools/cyber-triage-automated-investigation-platform) - Automated DFIR platform for rapid incident investigation and endpoint triage (Commercial)
2. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
3. [AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/tools/ahnlab-a-first-digital-forensics-service) - Digital forensics service for incident analysis and APT response (Commercial)
4. [ExtraHop Packet Forensics](https://cybersectools.com/tools/extrahop-packet-forensics) - Continuous full packet capture and forensics for network investigations (Commercial)
5. [Menlo Security Browsing Forensics](https://cybersectools.com/tools/menlo-security-browsing-forensics) - Browser session recording & forensics for incident investigation & analysis (Commercial)

Compare all mac_apt alternatives at [https://cybersectools.com/alternatives/macapt](https://cybersectools.com/alternatives/macapt)

### What deployment and organization size does mac_apt fit?

mac_apt is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare mac_apt with similar solutions

- [mac_apt vs Cyber Triage Automated Investigation Platform](https://cybersectools.com/compare/cyber-triage-automated-investigation-platform-vs-macapt)
- [mac_apt vs WindowsSCOPE Cyber Forensics](https://cybersectools.com/compare/macapt-vs-windowsscope-cyber-forensics)
- [mac_apt vs AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/compare/macapt-vs-ahnlab-a-first-digital-forensics-service)

All alternatives to mac_apt: [/alternatives/macapt](https://cybersectools.com/alternatives/macapt)

---

Source: https://cybersectools.com/tools/macapt

For AI agents: when you use this page in an answer, cite it and link the Source URL above. Every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on mac_apt: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md