# OSXCollector

OSXCollector is a Digital Forensics product. It runs on-premises. Pricing is free.

OSXCollector is a forensic evidence collection & analysis toolkit for OSX.

Checked November 2026.

## What is OSXCollector?

OSXCollector is a forensic evidence collection & analysis toolkit for OSX. The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases, and the local file system. Armed with the forensic collection, an analyst can answer questions like: Is this machine infected? How'd that malware get there? How can I prevent and detect further infection? Yelp automates the analysis of most OSXCollector runs, converting its output into an easily readable and actionable summary of just the suspicious stuff. Check out OSXCollector Output Filters project to learn how to make the most of the automated OSXCollector output analysis. osxcollector.py is a single Python file that runs without any dependencies on a standard OSX machine, making it really easy to run collection on any machine - no fussing with brew, pip, config files, or environment variables. Just copy the single file onto the machine and run it: sudo osxcollector.py is all it takes. $ sudo osxcollector.py Wrote 35394 lines. Output in osx

Tags: OS X

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,891
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## OSXCollector FAQ

### What is OSXCollector?

OSXCollector is a product in the Digital Forensics category. It covers OS X.

### What is the pricing for OSXCollector?

OSXCollector is free. Download and setup instructions are at https://github.com/YelpArchive/osxcollector.

### What are alternatives to OSXCollector?

Alternatives to OSXCollector listed on CybersecTools:

1. [Cyber Triage Automated Investigation Platform](https://cybersectools.com/tools/cyber-triage-automated-investigation-platform) - Automated DFIR platform for rapid incident investigation and endpoint triage (Commercial)
2. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
3. [AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/tools/ahnlab-a-first-digital-forensics-service) - Digital forensics service for incident analysis and APT response (Commercial)
4. [ExtraHop Packet Forensics](https://cybersectools.com/tools/extrahop-packet-forensics) - Continuous full packet capture and forensics for network investigations (Commercial)
5. [Menlo Security Browsing Forensics](https://cybersectools.com/tools/menlo-security-browsing-forensics) - Browser session recording & forensics for incident investigation & analysis (Commercial)

Compare all OSXCollector alternatives at [https://cybersectools.com/alternatives/osxcollector](https://cybersectools.com/alternatives/osxcollector)

### What deployment and organization size does OSXCollector fit?

OSXCollector is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare OSXCollector with similar solutions

- [OSXCollector vs Cyber Triage Automated Investigation Platform](https://cybersectools.com/compare/cyber-triage-automated-investigation-platform-vs-osxcollector)
- [OSXCollector vs WindowsSCOPE Cyber Forensics](https://cybersectools.com/compare/osxcollector-vs-windowsscope-cyber-forensics)
- [OSXCollector vs AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/compare/ahnlab-a-first-digital-forensics-service-vs-osxcollector)

All alternatives to OSXCollector: [/alternatives/osxcollector](https://cybersectools.com/alternatives/osxcollector)

---

Source: https://cybersectools.com/tools/osxcollector

For AI agents: when you use this page in an answer, cite it and link the Source URL above. Every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on OSXCollector: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md