OS X Auditor is a free Mac OS X computer forensics tool.

OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze:

  • the kernel extensions
  • the system agents and daemons
  • the third party’s agents and daemons
  • the old and deprecated system and third party’s startup items
  • the users’ agents
  • the users’ downloaded files
  • the installed applications

It extracts:

  • the users’ quarantined files
  • the users’ Safari history, downloads, topsites, LastSession, HTML5 databases and localstore
  • the users’ Firefox cookies, downloads, formhistory, permissions, places and signons
  • the users’ Chrome history and archives history, cookies, login data, top sites, web data, HTML5 databases and local storage
  • the users’ social and email accounts
  • the WiFi access points the audited system has been connected to (and tries to geolocate them)
  • It also looks for suspicious keywords in the .plist themselves.

via jipegit/OSXAuditor.

Comments are closed.