https://cybertoolchain.io/tools/mac-apt New releases and features in mac_apt, tracked by The Cyber Toolchain. en Sat, 10 Oct 2026 04:02:40 GMT https://github.com/ydkhatri/mac_apt/releases/tag/v.1.36.2 https://github.com/ydkhatri/mac_apt/releases/tag/v.1.36.2 Sat, 10 Oct 2026 04:02:40 GMT mac_apt v1.36.2 adds CALCULATOR and AKD plugins, new wifiagent.plist parsing, new XPdb location, and Safari tags support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `CALCULATOR` plugin to read calculator history from macOS artifacts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `AKD` plugin to read device and email alias info from Authkit daemon (`com.apple.akd`) databases. • Adds parsing of `wifiagent.plist` for wifi artifact collection. • Adds support for a new `XPdb` location in XProtect artifact parsing. • Adds reading of Safari tags via the `SAFARI` plugin. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.33.2 https://github.com/ydkhatri/mac_apt/releases/tag/v1.33.2 Mon, 20 Jul 2026 13:26:22 GMT mac_apt v1.33.2 adds Biome and Trash plugins, compressed DMG support, SFL4 in RECENTITEMS, and richer bookmark metadata. • New BIOME plugin parses Apple Biome data from macOS artifacts. • New TRASH plugin extracts deleted file/folder metadata from .DS_Store files in the .Trash folder. • Supports compressed DMG images (based on dmgwiz), expanding disk image compatibility. • Adds SFL4 processing to the RECENTITEMS plugin for broader recent-items coverage. • Extracts volume info and item creation date from RECENTITEMS bookmarks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.29.0 https://github.com/ydkhatri/mac_apt/releases/tag/v1.29.0 Wed, 11 Feb 2026 14:21:27 GMT mac_apt v1.29.0 adds UAC collection parsing, Python 3.13 base • `UAC` collection support is added for extracting User Account Control artifact data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.28.7 https://github.com/ydkhatri/mac_apt/releases/tag/v1.28.7 Sun, 07 Dec 2025 05:41:19 GMT mac_apt v1.28.7 adds Python 3.14 compatibility with new compiled executables • Adds support for running mac_apt on Python 3.14 environments. • Includes pre-compiled executables built against Python 3.14 for macOS and Windows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.26.1 https://github.com/ydkhatri/mac_apt/releases/tag/v1.26.1 Mon, 28 Jul 2025 14:30:08 GMT mac_apt v1.26.1 adds KEYCHAINS, LAUNCHPAD, FACETIME plugins and published compiled binaries • Adds `KEYCHAINS` plugin to parse System keychain data using Chainbreaker logic • Adds `LAUNCHPAD` plugin for new Launchpad artifact extraction • Adds `FACETIME` plugin for new FaceTime artifact extraction • Adds parsing of Secure Preferences for Extension data in the existing `CHROMIUM` plugin Breaking changes: • The `Unifiedlogs` plugin has been removed; use the new `UnifiedLogExport` plugin instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.13.6 https://github.com/ydkhatri/mac_apt/releases/tag/v1.13.6 Tue, 06 May 2025 12:29:13 GMT mac_apt v1.13.6 adds Velociraptor collection support, JSONL output, new plugins and `--exclude` filtering • `--exclude` flag allows specifying plugins to skip during analysis • `jsonl` output type enables line-delimited JSON records for streaming ingestion • `COLLECTION` module reads Velociraptor created zip file collections (collected using the `MacOS.Search.FileFinder` module) • New `CALLHISTORY` plugin collects call history data • New `CRASHREPORTER` plugin parses crash reporter logs • New `WIFI_INTELLIGENCE` plugin extracts WiFi intelligence data • `FSEVENTS` plugin now includes CoreSimulator file system events • AUTOSTART plugin significantly updates BTM parsing logic • SAVEDSTATE plugin fetches additional window titles from decrypting data.data and adds Dock saved info Breaking changes: • `mac_apt_mounted_sys_data.py` has been removed as it was unused Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.7.5-dev https://github.com/ydkhatri/mac_apt/releases/tag/v1.7.5-dev Sat, 11 May 2024 08:09:58 GMT mac_apt v1.7.5-dev adds plugins for TCC, UTMPX, ASL, SCREENSHARING, XPROTECTBEHAVIOR, MSRDC and supports 3SLD/Arc/Safari profiles • Added support for 3SLD format (fsevents) • `Added support for Arc Browser` • `Added support for sfl3` • `Add a plugin for ASL` • `Added SCREENSHARING plugin` • `Added support for Safari profiles and tab snapshots` • `Added XPROTECTBEHAVIOR plugin` • `Added MSRDC (Microsoft Remote Desktop) plugin` • `Identify and process data from deleted User's DARWIN_ cache folders` • Supports [ASLA](https://github.com/giuseppetotaro/asla) produced SPARSEIMAGE files now Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.5.8-dev https://github.com/ydkhatri/mac_apt/releases/tag/v1.5.8-dev Fri, 16 Jun 2023 15:15:57 GMT mac_apt v1.5.8-dev adds macOS 13/Ventura support, Docker image parsing, SNSS v3/CHROMIUM coverage, and a new FIREFOX plugin. • Adds Ventura (macOS 13) support including reading RSR • Adds `SNSS v3` support for chromium browsers • Extends `CHROME` plugin to `CHROMIUM` covering more CHROMIUM based browsers • Updates `spotlight database paths` for macOS 12+ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt https://github.com/ydkhatri/mac_apt/releases/tag/v1.5.0-dev https://github.com/ydkhatri/mac_apt/releases/tag/v1.5.0-dev Tue, 14 Jun 2022 12:26:22 GMT mac_apt v1.5.0-dev adds CSV output, TCC/XPROTECTDIAG plugins, and SafariTabs.db parsing • Adds `--csv` CLI flag to export plugin results as comma-separated values (formerly TSV only) • Adds `TCC` plugin to parse Transitory Control Center records • Adds `XPROTECTDIAG` plugin to analyze XProtect diagnostics data • Adds `SafariTabs` plugin to parse SafariTabs.db browser tab history Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mac-apt