AutoMacTC: A Modular Forensic Triage Collection Framework for macOS
AutoMacTC is a modular forensic triage collection framework designed for macOS. It accesses a variety of forensic artifacts, parses these artifacts, and presents them in formats that are suitable for analysis.
Compatibility and Requirements for Operation
The software can be executed on live systems or non-functional disks. It requires Python version 3.9 or earlier. Additionally, it is compatible with macOS major releases ranging from 10.11 to 11.2.3, including support for the M1 processor.
It supports triage against mounted disk images from macOS 10.11 to 10.15
It allows for triage operations on mounted disk images from macOS systems ranging from version 10.11 to 10.15.