# macos-collector v1.7.0 Released: The Ultimate Automated DFIR Tool for Apple Endpoints > Discover how macos-collector v1.7.0 automates macOS forensic artifact collection for DFIR, leveraging Aftermath and KnockKnock for rapid incident response. - Canonical URL: https://coreiten.com/en/article/macos-collector-v170-released-the-ultimate-automated-dfir-tool-for-apple-endpoints - Language: en - Section: macOS - Author: Sami - Published: 2026-09-04T00:02:31+03:00 - Modified: 2026-09-04T00:02:31+03:00 - Publisher: CoreITen (https://coreiten.com) - Keywords: macos-collector v1.7.0, macOS forensics, DFIR, Jamf Aftermath, KnockKnock, TrueTree, incident response, Apple security ## Summary The release of macos-collector v1.7.0 provides security teams with an automated shell script to streamline Apple endpoint forensic investigations. - The tool leverages Aftermath v2.3.0 developed by Jamf Threat Labs as its core framework for artifact collection. - It bundles 7-Zip v26.00, KnockKnock v4.0.3, and TrueTree v0.8 to provide responders with immediate diagnostic capabilities. - The script automates the extraction of critical data including Apple Unified Logs, Background Task Management dumps, and Biome data. - Investigators can use specific commands such as sudo bash macos-collector.sh --triage to perform a complete system triage. - The default password for securing the main archive is IncidentResponse, while quarantined files use infected. **Why it matters:** This tool represents a crucial shift toward automated triage as macOS-specific info-stealers and persistence mechanisms rise in corporate environments. --- Security teams responding to compromised Apple endpoints have a powerful new utility at their disposal with the release of macos-collector v1.7.0. This comprehensive shell script is designed to automate the collection and analysis of macOS forensic artifacts, streamlining Digital Forensics and Incident Response (DFIR) workflows. By acting as a centralized orchestrator, the tool eliminates the need for investigators to manually run disparate command-line utilities during a critical security incident. At its core, macos-collector heavily leverages [Aftermath](https://github.com/jamf/aftermath), an open-source incident response framework developed by Jamf Threat Labs. However, the script goes significantly further by bundling essential external tools by default. This ensures that responders have immediate access to a full suite of diagnostic capabilities without needing to download additional dependencies on a potentially compromised machine. ### Comprehensive Artifact Collection and Dependencies The v1.7.0 release is built to extract a wide array of critical system data necessary for identifying malicious activity. The script automates the extraction of Apple Unified Logs (AUL), Background Task Management (BTM) dumps, DS_Store files, and File System Events (FSEvents). Furthermore, it captures Sysdiagnose logs, Spotlight database files (including live searches), Recent Items, Notification Center databases, and Biome data. To achieve this deep level of system introspection, macos-collector relies on specific, pre-packaged versions of industry-standard security tools. The current build includes 7-Zip v26.00 for secure archiving, Aftermath v2.3.0 for core artifact collection, KnockKnock v4.0.3 for live system persistence enumeration, and [TrueTree](https://github.com/themittenmac/TrueTree) v0.8 for process tree snapshot collection. The tool also checks system information, such as verifying if the native XProtect anti-malware signatures are up to date. ### How to Deploy and Run macos-collector Because macos-collector interacts with deeply embedded system files, it requires root privileges and specific system permissions to function correctly. Furthermore, to preserve the integrity of the compromised endpoint, investigators must follow strict operational security practices. - **Minimize Disk Writes:** The script writes its output directly to the current working directory. It is highly recommended to execute the tool from a remote location or an external device, such as a USB flash drive, to prevent overwriting volatile forensic evidence on the target disk. - **Grant Full Disk Access:** Aftermath requires Full Disk Access (FDA) to read protected directories. Navigate to System Settings, select Privacy & Security, and open Full Disk Access. Click the + button, authenticate, and add your Terminal application. You must restart the Terminal for changes to take effect. - **Archive Security:** All collected data is securely archived. The default password for the main archive is `IncidentResponse`, while the password for quarantined files is `infected`. Once the environment is prepared, investigators can use the following commands to initiate specific collection routines: To collect forensic artifacts using Aftermath: ```bash sudo bash macos-collector.sh --collect ``` To analyze a previously collected Aftermath archive file (ideally performed on a clean, isolated macOS endpoint): ```bash sudo bash macos-collector.sh --analyze ``` To specifically collect FSEvents data from the compromised endpoint: ```bash sudo bash macos-collector.sh --fsevents ``` To perform a complete triage and collect all supported macOS forensic artifacts: ```bash sudo bash macos-collector.sh --triage ``` ### The Shift Toward Automated macOS Triage The release of macos-collector v1.7.0 highlights a critical evolution in Apple enterprise security. Historically, macOS was perceived as a lower-priority target for threat actors, allowing security teams to rely on slower, manual forensic methodologies. However, with the recent surge in macOS-specific info-stealers and sophisticated persistence mechanisms, rapid triage is no longer optional - it is a baseline requirement. By wrapping complex tools like KnockKnock and TrueTree into a single, easily deployable shell script, macos-collector drastically reduces the time-to-insight during an active breach. The explicit requirement to run the tool via an external drive also reinforces proper forensic hygiene, ensuring that junior analysts do not accidentally trample over crucial file system events while attempting to gather data. As macOS continues to expand its footprint in corporate environments, automated, all-in-one collection scripts like this will become the standard first-response mechanism for security operations centers. ## Sources - [kitploit.com](https://kitploit.com/en/posts/github-lethal-forensics-macos-collector-v170)