MAESTRO FORENSICS
The global number one tool providing the most detailed analysis of the Mac operating system environment! macOS forensic analysis tool
MAESTRO WiSDOM macOS
Integrated Analysis Platform for Incident Forensics & Digital Forensics
OS Artifacts
[ 350 or more ]
File System Analysis
[ File System Viewer ]
Timeline Analysis
[ Timeline Analyzer ]
Correlation Analysis
[ Email, Image, and AI Correlation ]
OCR Text Extraction
[ Multilingual Translation ]
MAESTRO WiSDOM macOS
Mac forensic specialized solution
- Full support for the latest macOS version
[ macOS Sequoia (Version 15) ] - Compatible with Apple M-series and T2 security chips
- Used for information leakage investigation and internal audit purposes
- Analysis of key evidence in the Mac operating system, such as KnowledgeC and Biome
- Various digital evidence analysis with an intuitive UI and powerful features
MAESTRO WiSDOM macOS Key Features Shortcut
Data Recovery / File Carving
Data Recovery / File Carving Support
Support for carving major macOS databases (plist, etc.)
Supports carving for domestic file formats such as hwp(x), cell, and show.
1400+ file type carving possible
Physical recovery of carving files and additional analysis via Wisdom
Provides OCR text extraction / translation features
OCR text extraction from image, video, and audio files
Full support for Korean text
Multilingual translation feature provided (English, Japanese, Chinese)
Support for automatic translation of extracted text
Timeline Analysis
Provides the same professional analysis viewer environment as Windows
Supports time series classification for all extracted artifacts
Provides filtering based on activity categories
Provides filtering such as key keywords
Anyone can easily derive results through advanced filtering features.
Provides a specialized viewer for correlation analysis
Provides correlation analysis features based on file name/path and user information
Provides correlation analysis features for major macOS artifacts
Provides image/video file correlation analysis function
Provides network/process/device-based correlation analysis capabilities
Various graph layouts are possible to view intuitive data flow.
Information Leak Investigation Analysis
Provides specialized artifacts for data leak investigations
Collection of removable storage media activity history
Provides artifacts collected from suspected data leakage routes
Provides a list of files modified, executed, recently viewed files, etc.
KnowledgeC, Biome supports analysis of user activity information
Analysis of KnowledgeC app usage history, device information, and media history
KnowledgeC System Information, Web and Location Information Analysis
Analysis of Biome activity data and Safari access history
Analysis of app usage history, such as Apple Mail, Notes, and iMessage
Spotlight search index provided
Analysis of Store DB, Siri search, Terminal usage history, and Shortcuts search history
Analysis of Security, Maps, iWork Documents, and Contacts Index History
Provides other Spotlight index information analysis functions
macOS Remote Access / Management
macOS System Remote Access Analysis
Screen Sharing Connection Analysis
Analysis of terminal connection, executed commands, job status, etc.
Analysis of Remote Desktop access, accounts, etc.
Apple Device Connection Analysis
Extract and analyze Apple ID and Apple iTunes account information
Analysis of Apple device connection information
Apple Device Backup Analysis
macOS System Log Analysis
Analysis of various macOS system logs
Apple System Log (ASL) Log Analysis
Timesync Logs, Unified Logs, Crash Log Analysis
Support for password-locked file detection / analysis
Supports various password-protected file types. Supports detection/analysis of Hangul files below (hwp, hwpx).
Supports dictionary password decryption function
Supports brute-force encryption decryption
Hybrid encryption/decryption function support
Supports rule-based encryption/decryption functions
macOS Web Browser Integrated Analysis
Chrome web browser analytics support
Safari web browser analytics support
Integrated analysis of web browser artifacts installed on macOS
Analysis via a dedicated email viewer
Supports analysis of various email file types such as Outlook, Mbox, and eml(x).
Emails can be viewed via a dedicated viewer
Analysis of references, blind references, attachments, body content, etc. is possible
Integration with correlation analysis function possible
Analysis via a dedicated database viewer
Collection and Classification of Database File Types
macOS provides major database file viewers (plist, json, etc.)
Allows verification of the database's internal structure and in-depth analysis through the viewer
Support for cryptocurrency detection and analysis features
Cryptocurrency wallet address detection
Collection of Hot/Cold Wallet Addresses
Chromium browser-based plugin wallet information collection
Detection and collection of virtual currency wallet addresses, such as documents or images
Apple macOS Analysis
Analysis of default apps such as Apple Note, iMessage, and FaceTime
Analysis of internet browsers such as Safari and Chrome
App list, installation, execution, deletion, and app-related log analysis
Analysis of over 70 file types
Analysis of Key Evidence in the macOS Operating System
Support for download file analysis function
Analysis of Internet Downloaded Files
Analysis of KakaoTalk Download Files
Telegram Download File Analysis
Analysis of files downloaded to other user systems
Provides various professional viewers
File System Viewer for File System Analysis
Web Artifacts Viewer for Web Browser Integrated Analysis
Email Viewer for full email analysis
DB Viewer for Database Analysis
Image & Video Viewer dedicated to image and video analysis
Provision of various viewers required for other forensic analyses
[ Viewer development and updates following feasibility review upon customer request ]
MAESTRO WiSDOM macOS
You can check out all the features of professional macOS forensic analysis through the video.
