OSX_Forensics

Includes scripts investigating OSX systems.

Change process

Creating Tools

Create a new folder, add a small README.md saying what it does or why.

Create a requirements.txt with whatever python libraries your code needs.

Modifying Tools

If you add a new 3rd-party import, update the requirements.txt in the same folder.

Committing your changes

Create a local branch with a unique name:

git checkout -b myChange

Stage and commit your changes:

git add -ip
git commit -m "Some small message here"

Push your branch to the remote:

git push --set-upstream origin myChange

Create a pull request.

Get someone to review and approve it.

Merge it.

Available Tools

• Gemini-Parser: Forensic parser for Gemini iOS deep links and suggestions.
• NotificationParser: Parses iOS notification artifacts and resolves UIDs.
• OuraRing: Extracts preferences from Oura Ring iOS application data.
• Plist-Parsers: Collection of parsers including Chrome Cookies and Eventbrite data.
• file_scraper: Recursively extracts specific file types (db, plist, ips).
• iMessageQuery: Extracts data from iMessage chat.db/sms.db databases.
• knowledgeC: Extracts artifacts from knowledgeC.db.
• segb_parser: Tool for parsing SEGB files.