# macOS Forensics

> Use this tool when you need to investigate security incidents on macOS systems by parsing system artifacts and correlating timeline events. It integrates with tools like FSEParser and unifiedlog_iterator to analyze unified logs, FSEvents, Safari history, and system databases, providing valuable insights for digital forensics investigations. Ideal for use cases involving incident response, threat hunting, and compliance analysis on macOS devices.

Canonical page: https://skillsregistry.net/skills/x746b-mac-forensics  
JSON: https://api.skillsregistry.net/v1/skills/x746b-mac-forensics

## Description

Integrates with macOS forensic tools like FSEParser and unifiedlog_iterator to parse system artifacts, correlate timeline events, and detect security incidents across unified logs, FSEvents, Safari history, and system databases for digital forensics investigations.

## Trust

- **Trust score (0–1):** 0.62
- **Verification tier:** scanned
- **Last scanned:** 2026-09-02

## Facts

- **Version:** 1.0.0
- **Skill type:** atomic
- **Execution layer:** mcp-remote
- **Runtime environment:** api
- **Category:** database
- **Updated:** 2026-09-02

## Source

- **Source listing:** [PulseMCP](https://www.pulsemcp.com/servers/x746b-mac-forensics)
- **Repository:** <https://github.com/x746b/mac_forensics-mcp>

## Use it

Resolve this record through the SkillsRegistry MCP server (no auth, read-only):

```
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_skill",
    "arguments": {
      "slug": "x746b-mac-forensics"
    }
  }
}
```

REST: `GET https://api.skillsregistry.net/v1/skills/x746b-mac-forensics` · pull for local use: `GET https://api.skillsregistry.net/v1/skills/x746b-mac-forensics/pull`

---
SkillsRegistry indexes agent skills from public registries and GitHub. Skills we have analysed are scanned with Circle-IR and scored on six dimensions; each listing states its scan coverage. More: https://skillsregistry.net/llms.txt