Code Monkey home page Code Monkey logo

macos-catalinaforensicstool's Introduction

CatalinaForensicsTool

A GUI frontend for AppleScript (shell, etc) based forensic artifact retreival.

See Wiki for detailed information.

But what its really about is providing a building block so, so anyone can add in stuff, make it their own. Its not exactly simple to get Cocoa, and AppleScript talking to terminal, and using their own binaries. This app lays things out pretty understandably. Just be aware of how things are delegated and assigned, and you shouldnt have a problem adding on. The hardest part is getting familiar with Xcode.

DOES NOT USE SANDBOX.

Relies on AppleScriptObjC for operation.

Requires various permissions.

  • Full Disk Access
  • System Events.app

If you are not prepared to debug any minor quirks / build failures from things in progress, stick with the releases tab. Those have actually been tested and are bookmarked for functionality. They're not actually "releases" as in full suites.

This is not indended to be a standard consumer / production app, as its operation violates many core traits of normal macOS app operation. It is not malicious in any way, just not something the average Jill/Joe should be messing around with in general.

Forensic Disclaimer:

This is a ongoing project, and should not be considered a completed product.


Future Functionality:

  • There might be more stuff available in the protected volumes that can be mounted with SIP disabled.
  • See Issues

Known Quirk(s)

  • Dont open more than one instance. Doing so sometimes crashes things.
  • See Issues

Two ways to run:

  1. Compile it yourself! (BETTER, SAFER WAY. You should check what a program like this is doing)
  2. Download the release .app and run the following command on the file: xattr -cr CatalinaExporter.app
  3. You must give CatalinaExporter.app full disk access for some functions to work.

Screenshot of Current (Release) State

Credits:

macos-catalinaforensicstool's People

Contributors

andrewbluepiano avatar vjc4861 avatar rkrueger9 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar Robert avatar  avatar Owen Hael avatar

Watchers

James Cloos avatar  avatar  avatar BillG avatar

macos-catalinaforensicstool's Issues

Double first warning notification window issue.

Sometimes a second warning window pops up after the first, and crashes the program. You then have to quit and reopen the program.

This only occurs during the initial opening of the program, in the few seconds after you click "ok" in the normal warning notification, it will not pop up again during operation.

Password Verification

  • The check password function isnt exactly working as expected. If you dont enter the right password in the main window it wont tell you right now. It just wont display the "Auth Success" notification, and it wont be able to get all the data.
    • Planned fix method:
      1. Ideal fix would to be to automate entering the password from the main window into the popup asking for creds, but I would hope thats not possible to automate with AppleScript for several reasons. But if it is, and there is a secure way to do that, develemontally speaking that would be ideal.
      2. More likely to be just changing the the password check function works.

Export Management

Add in setup to allow users to enter case / project name, check if directory already exists, etc

User Custom Functions

  • Add in easy way for users to create their own functions via gui
    • Take the existing functions, break down to what their core operations are, and provide those as templates to users. Have new functions do a test run before adding them to confirm its expected behavior. Ex:
      • Select the type of output, show different options for managing the output of various types (txt, plist, xml, sqlite, etc)
      • Set output folder subdir name
      • Set tooltip
      • Admin (y/n) each line
      • When to timestamp in function flow
      • Manual or '>' output redirection.

Icon Fix

The icon is using the wrong magnifying glass. This will be fixed as soon as I have time to get to a decent quality scanner.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.