As the adoption of Mac work spreads among companies and public institutions and the demand for digital forensics in the macOS environment increases, a domestic security specialist has launched an evidence collection and imaging solution that supports the latest Mac environment.

Maestro Forensic announced on the 7th that it has launched 'Maestro Wisdom Collector,' a digital forensic evidence collection and imaging solution.

This product supports the latest operating systems, macOS 26 (Tahoe) and Apple Silicon M1 to M5, and was unveiled as an integrated evidence collection solution that encompasses existing Windows, Linux, and mobile environments.

WiSDOM Collector supports both Live imaging, which collects current information such as memory and running processes while the system is powered on, and Power Off imaging, which replicates the storage device exactly as it is while the power is off.

The collectible digital artifacts include over 250 for macOS, 250 for Windows, and over 120 for Linux, comprising user account information, program execution history, system logs, network information, and spoilers.Trit search history, etc., are automatically collected.

It supports ZIP, AFF4, Sparse Image, and MAEFDB storage formats, allowing it to be utilized according to the analysis environment of each institution.

WiSDOM Collector supports integrity verification by automatically calculating MD5, SHA-1, SHA-256, and SHA-512 hash values during the evidence collection process.

Data collected on macOS is directly integrated with the MAESTRO WiSDOM macOS analysis tool, and can be processed from evidence collection to analysis on a single platform.

The company explained that it can also be utilized in security incident investigations where information needs to be obtained while the system is running, such as LotL (Living off the Land) attacks and fileless attacks.

"How quickly digital evidence is secured immediately after an accident occurs is becoming a critical factor in identifying the cause and preventing the spread of damage," said Kim Jong-kwang, CEO of Maestro Forensic. "We have advanced our capabilities to enable rapid evidence collection and analysis even in the latest macOS and Apple Silicon-based environments."