ATC-NY's Mac Marshal™ Products
Mac Marshal™ extracts and analyzes digital evidence from Mac OS X systems.
Mac Marshal Forensic Edition™ runs on an investigator's Mac workstation to analyze a disk image or mounted disk. Get the Forensic Edition here!
Mac Marshal Field Edition™ runs on a Mac target machine from a USB drive. It extracts volatile system state data, including a snapshot of physical RAM. The Field Edition also analyzes disk-based data, with the same capabilities as the Forensic Edition. Get the Field Edition here!