Mac Marshal™ extracts and analyzes digital evidence from Mac OS X systems.

Forensic Edition 3.0

Mac Marshal Forensic Edition™ runs on an investigator's Mac workstation to analyze a disk image or mounted disk. Get the Forensic Edition here!

Field Edition 3.0

Mac Marshal Field Edition™ runs on a Mac target machine from a USB drive. It extracts volatile system state data, including a snapshot of physical RAM.  The Field Edition also analyzes disk-based data, with the same capabilities as the Forensic Edition. Get the Field Edition here!