Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for Mac artefact filetypes #175

Open
owentl opened this issue Aug 8, 2024 · 2 comments
Open

Support for Mac artefact filetypes #175

owentl opened this issue Aug 8, 2024 · 2 comments
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@owentl
Copy link

owentl commented Aug 8, 2024

I appreciate that chainsaw was written to support evtx files, but is there any way to also support Mac logs too? Or has anyone ever run across a tool like chainsaw for Mac?
@alexkornitzer
Copy link
Collaborator

Thre is nothing preventing Chainsaw from supporting Mac logs it is just that no one has added the file parsers to Chainsaw to handle them. Currently Chainsaw supports:

  • esedb
  • hve
  • evtx
  • json
  • mft
  • xml

To handle Mac artefacts it would probably need parsers for plist, bplist, sqlite, unifiedlogs. Depending on what Mac artefacts are to be consumed.

@alexkornitzer alexkornitzer added enhancement New feature or request good first issue Good for newcomers labels Aug 19, 2024
@alexkornitzer alexkornitzer changed the title Chainsaw for Mac Support for Mac artefact filetypes Aug 19, 2024
alexkornitzer added a commit that referenced this issue Aug 19, 2024
@alexkornitzer
fix: ignore incorrect link dates (#175)
c4d9450 
Yet again the amcache can have invalid data in it. This makes more
exceptions to work around version numbers being written into the link
date.
@alexkornitzer
Copy link
Collaborator

^ Ignore the above commit, I linked the wrong issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@alexkornitzer @owentl