You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I appreciate that chainsaw was written to support evtx files, but is there any way to also support Mac logs too? Or has anyone ever run across a tool like chainsaw for Mac?
Thre is nothing preventing Chainsaw from supporting Mac logs it is just that no one has added the file parsers to Chainsaw to handle them. Currently Chainsaw supports:
esedb
hve
evtx
json
mft
xml
To handle Mac artefacts it would probably need parsers for plist, bplist, sqlite, unifiedlogs. Depending on what Mac artefacts are to be consumed.
Hi @alexkornitzer, looking at this with fresh eyes given your earlier scoping comment (plist, bplist, sqlite, unifiedlogs).
Each of those is pretty different in scope. plist (XML + binary, via the plist crate) feels like a long weekend's work, sqlite is a few days once a generic table-row container exists, and unifiedlogs is its own multi-week project. So this issue as a whole is umbrella-shaped, not a single PR.
Would you be open to splitting it into per-format tickets so the good first issue label can sit on a genuinely small one? Happy to take a stab at plist first if you'd like, since it covers a useful slice of macOS persistence on its own (LaunchAgents, LoginItems, plist-based services).
Sure, feel free to create issues that link to this issue, so let me kill off the GFI label and you can create any issues you want for things you wish to work on. So maybe just make a plist issue to start if that is what you would like to work on next?
Activity
alexkornitzer commentedon Aug 8, 2024
Thre is nothing preventing Chainsaw from supporting Mac logs it is just that no one has added the file parsers to Chainsaw to handle them. Currently Chainsaw supports:
To handle Mac artefacts it would probably need parsers for plist, bplist, sqlite, unifiedlogs. Depending on what Mac artefacts are to be consumed.
[-]Chainsaw for Mac[/-][+]Support for Mac artefact filetypes[/+]fix: ignore incorrect link dates (#175)
alexkornitzer commentedon Aug 19, 2024
^ Ignore the above commit, I linked the wrong issue.
Fuzzdkk commentedon Apr 27, 2026
Hi @alexkornitzer, looking at this with fresh eyes given your earlier scoping comment (plist, bplist, sqlite, unifiedlogs).
Each of those is pretty different in scope. plist (XML + binary, via the
plistcrate) feels like a long weekend's work, sqlite is a few days once a generic table-row container exists, and unifiedlogs is its own multi-week project. So this issue as a whole is umbrella-shaped, not a single PR.Would you be open to splitting it into per-format tickets so the
good first issuelabel can sit on a genuinely small one? Happy to take a stab at plist first if you'd like, since it covers a useful slice of macOS persistence on its own (LaunchAgents, LoginItems, plist-based services).alexkornitzer commentedon Apr 28, 2026
Sure, feel free to create issues that link to this issue, so let me kill off the GFI label and you can create any issues you want for things you wish to work on. So maybe just make a
plistissue to start if that is what you would like to work on next?