OSX Evidence Collection > macOS Artifact Parsing Tool (mac_apt)

Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.