免費的Mac OS X計算機取證工具：OSX Auditor

OSX Auditor是一個免費的Mac OS X計算機取證工具，這個工具顯示分析內核擴展、用戶下載的文件等等，然后是提取用戶的隔離文件、訪問歷史等等，最后就可以確認文件的可信度。

OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze:

• the kernel extensions
• the system agents and daemons
• the third party's agents and daemons
• the old and deprecated system and third party's startup items
• the users' agents
• the users' downloaded files
• the installed applications

It extracts:

• the users' quarantined files
• the users' Safari history, downloads, topsites, LastSession, HTML5 databases and localstore
• the users' Firefox cookies, downloads, formhistory, permissions, places and signons
• the users' Chrome history and archives history, cookies, login data, top sites, web data, HTML5 databases and local storage
• the users' social and email accounts
• the WiFi access points the audited system has been connected to (and tries to geolocate them)

項目主頁：http://www.baiduhome.net/lib/view/home/1410838226945