OSXCollector Logo

OSXCollector

0
Free
Visit Website

OSXCollector is a forensic evidence collection & analysis toolkit for OSX. The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases, and the local file system. Armed with the forensic collection, an analyst can answer questions like: Is this machine infected? How'd that malware get there? How can I prevent and detect further infection? Yelp automates the analysis of most OSXCollector runs, converting its output into an easily readable and actionable summary of just the suspicious stuff. Check out OSXCollector Output Filters project to learn how to make the most of the automated OSXCollector output analysis. osxcollector.py is a single Python file that runs without any dependencies on a standard OSX machine, making it really easy to run collection on any machine - no fussing with brew, pip, config files, or environment variables. Just copy the single file onto the machine and run it: sudo osxcollector.py is all it takes. $ sudo osxcollector.py Wrote 35394 lines. Output in osx

FEATURES

ALTERNATIVES

Collects and organizes Linux OS data for detailed analysis and incident response.

Zenduty's platform provides real-time operational health monitoring and incident response orchestration to improve incident response times and build a solid on-call culture.

Scripts to automate the process of enumerating a Linux system through a Local File Inclusion (LFI) vulnerability.

Belkasoft offers cybersecurity solutions, training, and tools for businesses, law enforcement, and academia.

A tool for analyzing pentest screenshots using a convolutional neural network

WinSearchDBAnalyzer can parse and recover records in Windows.edb, providing detailed insights into various data types.

DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.

A simple Golang application for storing NIST National Software Reference Library Reference Data Set (NSRL RDS) with md5 and sha1 hash lookup searches.

PINNED