Yogesh Khatri (@swiftforensics)

mac_apt. macOS (& ios) Artifact Parsing Tool

MacForensics. Scripts to process macOS forensic artifacts

OneDrive. OneDrive log .ODL reader

spotlight_parser. Read and extract data from macOS spotlight databases

UnifiedLogReader. A parser for Unified logging tracev3 files

blackboxprotobuf. Blackbox protobuf is a library for decoding and modifying arbitrary protobuf messages without the protobuf type definition.

nska_deserialize. NSKeyedArchive plist deserializer

APFS_010. 010 template for apfs

Appx-Analysis. Scripts and tools created for appx analysis talk (Magnet summit 2019)

pyliblzfse. Python bindings for LZFSE

Presentations. Slides and material from my conference presentations

jarp. Just Another broken Registry Parser (JARP)

macOS_FE. Tools for macOS Forensic Bootable media

spotlight_queries. Queries for parsed spotlight database in sqlite

Android. Android forensics related scripts

awesome-forensics. A curated list of awesome forensic analysis tools and resources

Powershell_Basics. A collection of PowerShell tutorials and simple scripts to get people started

010_Templates. 010 editor templates for parsing various formats

Bash_Basics.

macosac. Forensic Artifact Collection Tool for macOS