Kali Linux

Ma2Tl : macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt

Ma2Tl is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of mac_apt.

Requirements

  • Python 3.7.0 or later
  • pytz
  • tzlocal
  • xlsxwriter

Installation

% git clone https://github.com/mnrkbys/ma2tl.git

Usage

% python ./ma2tl.py -h
usage: ma2tl.py [-h] [-i INPUT] [-o OUTPUT] [-ot OUTPUT_TYPE] [-s START] [-e END] [-t TIMEZONE] [-l LOG_LEVEL] plugin [plugin …]
Forensic timeline generator using mac_apt analysis results. Supports only SQLite DBs.
positional arguments:
plugin Plugins to run (space separated).
optional arguments:
-h, –help show this help message and exit
-i INPUT, –input INPUT
Path to a folder that contains mac_apt DBs.
-o OUTPUT, –output OUTPUT
Path to a folder to save ma2tl result.
-ot OUTPUT_TYPE, –output_type OUTPUT_TYPE
Specify the output file type: SQLITE, XLSX, TSV (Default: SQLITE)
-s START, –start START
Specify start timestamp. (ex. 2021-11-05 08:30:00)
-e END, –end END Specify end timestamp.
-t TIMEZONE, –timezone TIMEZONE
Specify Timezone: “UTC”, “Asia/Tokyo”, “US/Eastern”, etc (Default: System Local Timezone)
-l LOG_LEVEL, –log_level LOG_LEVEL
Specify log level: INFO, DEBUG, WARNING, ERROR, CRITICAL (Default: INFO)
The following 4 plugins are available:
FILE_DOWNLOAD Extract file download activities.
PERSISTENCE Extract persistence settings.
PROG_EXEC Extract program execution activities.
VOLUME_MOUNT Extract volume mount/unmount activities.
—————————————————————————-
ALL Run all plugins

Generated timeline example

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

6 days ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

6 days ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago