macos-collector v1.5.1

[1.5.1] - 2026-03-16

Fixed

• Minor fixes and improvements

macos-collector v1.5.0

[1.5.0] - 2026-03-09

Added

• TrueTree Snapshot Collection
• System Info: Microsoft AutoUpdate (MAU)
• System Info: Collecting MDE Quarantine Files → PW: infected
• System Info: Collecting MDE Diagnostic Logs
• System Info: MDE Network Connectivity
• System Info: Collecting Microsoft Intune Logs
• System Info: Apple Remote Desktop Artifacts
• Password-Protected ZIP Files (PKZIP 2.0) → PW: IncidentResponse

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: TrueTree Snapshot Collection

macos-collector v1.4.0

[1.4.0] - 2026-01-29

Added

• System Information Collection
• Recent Items Collection
• KnockKnock v4.0.3 (Optional: VirusTotal Lookup)
• Spotlight Indexing Status (Data Volume)

Fixed

• Minor fixes and improvements

macos-collector v1.3.0

[1.3.0] - 2025-12-07

Added

• Spotlight Database File Collection (incl. Live Searches)
• BTM Database File Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Spotlight Database File Collection (incl. Live Searches)

Fig 3: Spotlight Live Search - CSV Report Creation (mdfind, mdls, xattr and file hash calculation)

Fig 4: BTM Database File Collection (Note: There can be multiple databases located on disk.)

macos-collector v1.2.0

[1.2.0] - 2025-11-24

Added

• Sysdiagnose Logs Collection
• BTM Dump File Collection (Background Task Management)
• DSStore: DMG Creation (read-only)
• FSEvents: DMG Creation (read-only)
• Triage Mode: Collect ALL supported macOS Forensic Artifacts
• KnockKnock (Persistence Enumerator by Objective-See)

Fig 1: Help-Message

Fig 2: DMG Support

Fig 3: Mount DMG w/ Arsenal Image Mounter (Step #1)

Fig 4: Mount DMG w/ APFS for Windows by Paragon Software (Step #2)

Fig 5: Access to write-protected data w/ preserved Apple extended attributes

macos-collector v1.1.0

[1.1.0] - 2025-11-17

Added

• DSStore File Collection (.DS_Store)
• Unified Logs Collection

Fixed

• Minor fixes and improvements

Fig 1: Help-Message

Fig 2: Collecting DS_Store Files

Fig 3: Collecting Unified Logs (AUL)

macos-collector v1.0.0

[1.0.0] - 2025-10-30

Added

• Aftermath Collection
• Aftermath Analysis
• FSEvents Collection

Changed

• CHANGELOG.md