macos-collector v1.3.0

[1.3.0] - 2025-12-07

Added

• Spotlight Database File Collection (incl. Live Searches)
• BTM Database File Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Spotlight Database File Collection (incl. Live Searches)

Fig 3: Spotlight Live Search - CSV Report Creation (mdfind, mdls, xattr and file hash calculation)

Fig 4: BTM Database File Collection (Note: There can be multiple databases located on disk.)

macos-collector v1.2.0

[1.2.0] - 2025-11-24

Added

• Sysdiagnose Logs Collection
• BTM Dump File Collection (Background Task Management)
• DSStore: DMG Creation (read-only)
• FSEvents: DMG Creation (read-only)
• Triage Mode: Collect ALL supported macOS Forensic Artifacts
• KnockKnock (Persistence Enumerator by Objective-See)

Fig 1: Help-Message

Fig 2: DMG Support

Fig 3: Mount DMG w/ Arsenal Image Mounter (Step #1)

Fig 4: Mount DMG w/ APFS for Windows by Paragon Software (Step #2)

Fig 5: Access to write-protected data w/ preserved Apple extended attributes

macos-collector v1.1.0

[1.1.0] - 2025-11-17

Added

• DSStore File Collection (.DS_Store)
• Unified Logs Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Collecting DS_Store Files

Fig 3: Collecting Unified Logs (AUL)

macos-collector v1.0.0

[1.0.0] - 2025-10-30

Added

• Aftermath Collection
• Aftermath Analysis
• FSEvents Collection

Changed

• CHANGELOG.md