Passionate about the art and science of digital forensics.
MARS is a data extraction and recovery toolkit for macOS that salvages and recovers SQLite, plist, log, and cache data from a set of raw, carved files and matches them with artifacts of forensic interest from a reference system.
In some cases, MARS can recover thousands more database rows and hundreds of extra days of data beyond what exists in the original reference files alone.
- Easily mount EWF images directly in macOS via FUSE-T
- (Completely avoids kernel-level FUSE install)
- Automatic pseudo-logarchive creation, ready for Unified Logs parsing
- Database timeline plotter for SQLite with Plotly
- Add and edit targets using the Artifact Recovery Catalog (ARC) Manager
- Export and import anonymized exemplar catalog packages to share with other MARS users
- In-depth HTML documentation (no internet required)
- WiFi activity and location mapping
- Biome parsing with CCL Group's SEGB parser
- Firefox JSONLZ4 parsing
- Firefox cache parsing (extract images, HTML, etc.)
Repo: https://github.com/WarpedWing/MARS
A desktop companion for the file recovery application PhotoRec that helps you auto-remove filetypes you don't want — and keep the carved files organized.
- Live‑monitors PhotoRec’s output and automatically deletes unwanted types in completed
recup_dir.Xfolders - One‑click “Process” for existing PhotoRec output that’s already finished
- Optional reorganization into type‑based folders with configurable subfolder batch sizes
| From This | To This |
|---|---|