52 open-source Apple Data Formats & Forensics projects

Apple Data Formats & Forensics (Apple Ecosystem): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.

1. osxphotos★ 3,943 · active · Python

   Reads and exports Apple Photos libraries by parsing the Photos.sqlite database

2. ipsw★ 3,831 · active · Go

   iOS/macOS research Swiss Army knife: firmware, dyld cache, kernelcache parsing

3. AssetCatalogTinkerer★ 2,891 · active · Swift

   App to open Apple compiled asset catalog (.car) files and extract images

4. shortcuts-js★ 1,754 · archived · TypeScript

   JavaScript library to generate iOS Shortcuts files

5. cherri★ 1,658 · active · Go

   Programming language that compiles to Apple Shortcuts files

6. iLEAPP★ 1,408 · active · Python

   iOS Logs, Events, And Plist Parser

7. mac_apt★ 1,096 · active · Python

   macOS (& ios) Artifact Parsing Tool

8. iTunes-Backup-Explorer★ 1,075 · active · Java

   A graphical tool that can extract and replace files from encrypted and non-encrypted iOS backups

9. apple-notes-liberator★ 1,020 · dormant · Java

   Extracts Apple Notes data from the NoteStore database to JSON/HTML

10. osx-abi-macho-file-format-reference★ 884 · slowing

    Mirror of OS X ABI Mach-O File Format Reference

11. APOLLO★ 652 · slowing · Python

    Parses macOS/iOS pattern-of-life databases (KnowledgeC, Screen Time, etc.) into timelines

12. libplist★ 641 · active · C

    Library for Apple binary and XML property lists

13. AssetsExtractor★ 598 · dormant · Objective-C

    macOS tool that extracts images from Assets.car files and app bundles

14. dyld-shared-cache-extractor★ 587 · slowing · C

    A CLI for extracting libraries from Apple's dyld shared cache file

15. DyldExtractor★ 473 · archived · Python

    Extract Binaries from Apple's Dyld Shared Cache

16. macos-UnifiedLogs★ 384 · active · Rust

    Cross-platform Rust parser for Apple Unified Log (tracev3) files

17. img4lib★ 372 · dormant · C

    image4 vfs

18. sparsebundlefs★ 369 · active · C++

    FUSE filesystem for reading macOS sparsebundle disk images

19. iphonebackuptools★ 362 · dormant · JavaScript

    iOS Backup Data Extraction

20. libfvde★ 359 · active · C

    Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes

21. img4tool★ 336 · active · C++

    A tool for manipulating IMG4, IM4M and IM4P files

22. darling-dmg★ 306 · slowing · C++

    FUSE module for .dmg files (containing an HFS+ filesystem)

23. scpl★ 289 · dormant · TypeScript

    Text language that compiles to iOS Shortcuts files

24. iOSbackup★ 285 · slowing · Python

    A Python 3 class that reads and extracts files from a password-encrypted iOS backup created by iTunes on Mac and...

25. numbers-parser★ 260 · active · Python

    Python parser for Apple Numbers (.numbers) IWA files

26. go-macho★ 259 · active · Go

    Package macho implements access to and creation of Mach-O object files.

27. notesutils★ 249 · dormant · Python

    Utilities and format notes for extracting notes (protobuf) from Notes.app

28. keynote-parser★ 213 · active · Python

    Packer/unpacker for Apple Keynote (IWA protobuf) presentation files

29. MetalLibraryArchive★ 194 · dormant · Swift

    Extracts Metal functions from .metallib files

30. drat★ 188 · slowing · C

    Utility for performing data recovery and analysis of APFS partitions/containers.

31. libdmg-hfsplus★ 175 · dormant · C

    Portable libraries and utilities that manipulate HFS+ volumes and Apple's DMG images

32. EffectivePower★ 174 · slowing · Swift

    Viewer for Apple PLSQL power logs

33. xar★ 167 · dormant · C

    eXtensible ARchiver

34. QLCARFiles★ 156 · dormant · Objective-C

    QuickLook plugin for compiled Asset Catalog .car files

35. pbzx★ 140 · active · C

    Parser for Apple's pbzx stream format used in macOS installer payloads

36. shortcuts-swift★ 132 · archived · Swift

    Swift Playgrounds library to write iOS Shortcuts in code

37. imessage_tools★ 128 · dormant · Python

    Tools to read iMessage chat.db, including parsing of attributedBody on macOS Ventura+

38. imessage_reader★ 122 · slowing · Python

    Fetch imessages from chat.db

39. Open-Jellycore★ 122 · slowing · Swift

    Compiler for the Jelly language that outputs Apple Shortcuts

40. hfsfuse★ 105 · active · C

    FUSE driver for HFS+ filesystems

41. cartools★ 89 · dormant · Swift

    Swift toolkit for reading compiled Asset Catalog (.car) files

42. ccl-bplist★ 86 · dormant · Python

    Python Module for parsing Binary Property List and NSKeyedArchiver files

43. go-apfs★ 85 · active · Go

    APFS parser written in pure Go

44. crabapple★ 76 · active · Rust

    Rust library for reading and extracting encrypted iOS backups

45. PyIMG4★ 68 · active · Python

    A Python library/CLI tool for parsing Apple's Image4 format.

46. libgpod★ 64 · dormant · C

    Library to read and write the iPod/iTunes database (iTunesDB) reverse-engineered from Apple's format

47. shortcuts-toolkit★ 49 · slowing · JavaScript

    Generates Apple Shortcuts programmatically using the reverse-engineered binary plist format

48. libfshfs★ 42 · active · C

    Library and tools to access the Mac OS Hierarchical File System (HFS)

49. ipsw_parser★ 33 · active · Python

    python3 utility for parsing and extracting data from IPSW

50. libshortcutsign★ 24 · active · C

    Library for signing and verifying Apple's signed .shortcut file format

51. bpylist2★ 22 · slowing · Python

    Parse and Generate binary plists and NSKeyedArchiver archives

52. NSKeyedUnArchiver★ 14 · slowing · Python

    Python unarchiver for NSKeyedArchiver binary/text plists into usable dicts