macos-collector v1.6.1

[1.6.1] - 2026-07-20

Added

• Biome Data Collection (App.MenuItem)
• macOS 27 Golden Gate Support
• SystemInfo: System Firmware Version
• SystemInfo: Security Policy
• SystemInfo: LimaCharlie SecOps Cloud Platform (SCP)

Changed

• 7-Zip v26.00 → 7-Zip v26.02
• Command-Line Parameters → Long form only

Fixed

• Code Quality: ShellCheck Linter
• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Biome Data Collection (App.MenuItem)

Fig 3: Security Policy (e.g. EDR installation requires Reduced Security mode to enable third-party extensions)

Fig 4: LimaCharlie - SecOps Cloud Platform (SCP)

macos-collector v1.6.0

[1.6.0] - 2026-04-13

Added

• Notification Center Database File Collection
• Secure Archive Container (7-Zip) → PW: IncidentResponse
• System Info: XProtect Version Check
• System Info: Terminal Information (ClickFix Attacks)
• SystemInfo: Installed Browsers
• System Info: System Accounts
• System Info: User Details
• SystemInfo: Lockdown Files (Pairing Records)
• SystemInfo: iOS Backups
• SystemInfo: Time Machine
• SystemInfo: Apple Intelligence
• BTM Dump File: User Properties

Fig 1: Help-Message

Fig 2: Notification Center Database File Collection

Fig 3: Possible malware, Paste blocked (Terminal)

Fig 4: com.apple.Terminal.plist → UserAcknowledgedPasteWarning

Fig 5: Alert → User 'evild3ad' clicked on 'Paste Anyway'

Fig 6: Malware Detected, Paste Blocked (XProtect)

Fig 7: Unified Logs (XProtect Paste Protection)

log show --archive system_logs.logarchive --predicate 'process == "xprotectd" AND eventMessage CONTAINS "Prompting user about blocked paste event"'

Fig 8: Log Predicate (Unified Logs)

macos-collector v1.5.1

[1.5.1] - 2026-03-16

Fixed

• Minor fixes and improvements

macos-collector v1.5.0

[1.5.0] - 2026-03-09

Added

• TrueTree Snapshot Collection
• System Info: Microsoft AutoUpdate (MAU)
• System Info: Collecting MDE Quarantine Files → PW: infected
• System Info: Collecting MDE Diagnostic Logs
• System Info: MDE Network Connectivity
• System Info: Collecting Microsoft Intune Logs
• System Info: Apple Remote Desktop Artifacts
• Password-Protected ZIP Files (PKZIP 2.0) → PW: IncidentResponse

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: TrueTree Snapshot Collection

macos-collector v1.4.0

[1.4.0] - 2026-01-29

Added

• System Information Collection
• Recent Items Collection
• KnockKnock v4.0.3 (Optional: VirusTotal Lookup)
• Spotlight Indexing Status (Data Volume)

Fixed

• Minor fixes and improvements

macos-collector v1.3.0

[1.3.0] - 2025-12-07

Added

• Spotlight Database File Collection (incl. Live Searches)
• BTM Database File Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Spotlight Database File Collection (incl. Live Searches)

Fig 3: Spotlight Live Search - CSV Report Creation (mdfind, mdls, xattr and file hash calculation)

Fig 4: BTM Database File Collection (Note: There can be multiple databases located on disk.)

macos-collector v1.2.0

[1.2.0] - 2025-11-24

Added

• Sysdiagnose Logs Collection
• BTM Dump File Collection (Background Task Management)
• DSStore: DMG Creation (read-only)
• FSEvents: DMG Creation (read-only)
• Triage Mode: Collect ALL supported macOS Forensic Artifacts
• KnockKnock (Persistence Enumerator by Objective-See)

Fig 1: Help-Message

Fig 2: DMG Support

Fig 3: Mount DMG w/ Arsenal Image Mounter (Step #1)

Fig 4: Mount DMG w/ APFS for Windows by Paragon Software (Step #2)

Fig 5: Access to write-protected data w/ preserved Apple extended attributes

macos-collector v1.1.0

[1.1.0] - 2025-11-17

Added

• DSStore File Collection (.DS_Store)
• Unified Logs Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Collecting DS_Store Files

Fig 3: Collecting Unified Logs (AUL)

macos-collector v1.0.0

[1.0.0] - 2025-10-30

Added

• Aftermath Collection
• Aftermath Analysis
• FSEvents Collection

Changed

• CHANGELOG.md