Discover available forensic artifacts in a macOS triage collection. Returns inventory of logs, databases, plists, and user profiles.

Search macOS Unified Logs with filters. Supports regex patterns, subsystem/category/process filters, and time ranges.

Get pre-defined security events from Unified Logs. Event types: user_created, user_deleted, user_modified, ssh_session, sudo_usage, auth_success, auth_failure, process_exec, gatekeeper, tcc_prompt, login, logout, screen_lock, screen_unlock, remote_login, persistence

Get statistics about a Unified Log file: time range, top subsystems, top processes, total entry count.

Read and parse a macOS plist file. Optionally extract specific key path.

Search for keys matching a pattern across a plist file.

Extract all timestamp values from a plist file with UTC conversion.

Get application usage data from KnowledgeC.db. Shows what apps were used and when.

Get Safari browsing history with timestamps.

Extract search queries from Safari history (Google, Bing, etc.).

Get TCC (Transparency, Consent, Control) permissions. Shows which apps have camera, mic, screen recording access.

Get quarantine events (file downloads) from QuarantineEventsV2. Shows download source, app that downloaded, timestamp.

Get user accounts from a triage collection, including deleted users.

Get extended attributes (xattr) for a file. Contains true download times, quarantine info, and user-action dates more accurate than DB records.

Search Spotlight index for file metadata. Contains info even for deleted files.

Get statistics about a Spotlight index: total entries, content types, top directories.

Search FSEvents records for file system activity. Shows file creation, deletion, modification, and rename operations.

Get statistics about FSEvents records: total count, time range, event type counts.

Build a unified timeline from multiple forensic artifacts. Correlates events from unified logs, Safari history, KnowledgeC, and plists.

Build a timeline for a specific user account. Shows account creation, modification, deletion, and related activity.

Deep investigation of a specific event type. Correlates evidence across multiple artifacts. Event types: user_deletion, user_creation, file_download, ssh_session, malware_execution, privilege_escalation.

Parse fsck_apfs.log to find volume creation, external device connections, and anti-forensics activity. Shows APFS volume formatting operations with timestamps.

Get statistics about fsck_apfs.log: devices checked, volumes found, external devices, time range.