# Aftermath | A Free macOS IR Framework

**URL:** <https://onehack.st/t/aftermath-a-free-macos-ir-framework/230376>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [March 2, 2023, 12:56pm UTC](https://onehack.st/t/aftermath-a-free-macos-ir-framework/230376 "2023-03-02T12:56:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [March 2, 2023, 12:56pm UTC](https://onehack.st/t/aftermath-a-free-macos-ir-framework/230376/1 "2023-03-02T12:56:00Z")

</div>

[![](https://github.com/jamf/aftermath/raw/main/AftermathLogo.png)](https://github.com/jamf/aftermath/blob/main/AftermathLogo.png)

[![](https://camo.githubusercontent.com/c7c2721844d56dddf5abe70616c0649238743fd6072e48cc102b1e4f10a80ce4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f72656c656173652d312e312e302d627269676874253230677265656e)](https://camo.githubusercontent.com/c7c2721844d56dddf5abe70616c0649238743fd6072e48cc102b1e4f10a80ce4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f72656c656173652d312e312e302d627269676874253230677265656e) [![](https://camo.githubusercontent.com/9f6e37a37ac15189330b00d8db468a04b21e4026c2c41f71850ac3b3ed06a4c2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6d61634f532d31322e302532422d626c7565)](https://camo.githubusercontent.com/9f6e37a37ac15189330b00d8db468a04b21e4026c2c41f71850ac3b3ed06a4c2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6d61634f532d31322e302532422d626c7565) [![](https://camo.githubusercontent.com/afa3b4832847df4bdf741044e496aa501da653e7d9c9cbb60091f3faa5bcb673/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d6f72616e6765)](https://camo.githubusercontent.com/afa3b4832847df4bdf741044e496aa501da653e7d9c9cbb60091f3faa5bcb673/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d6f72616e6765)

## About

Aftermath is a Swift-based, open-source incident response framework.

Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM (ideally), but it can also run independently from the infected user’s command line.

Aftermath first runs a series of modules for collection. The output of this will either be written to the location of your choice, via the `-o` or `--output` option, or by default, it is written to the `/tmp` directory.

Once collection is complete, the final zip/archive file can be pulled from the end user’s disk. This file can then be analyzed using the `--analyze` argument pointed at the archive file. The results of this will be written to the `/tmp` directory. The administrator can then unzip that analysis directory and see a parsed view of the locally collected databases, a timeline of files with the file creation, last accessed, and last modified dates (if they’re available), and a storyline which includes the file metadata, database changes, and browser information to potentially track down the infection vector.

## Build

To build Aftermath locally, clone it from the repository

git clone [https://github.com/jamf/aftermath.git](https://github.com/jamf/aftermath.git)

`cd` into the Aftermath directory

cd \<path\_to\_aftermath\_directory\>

Build using Xcode

xcodebuild

`cd` into the Release folder

cd build/Release

Run aftermath

sudo ./aftermath

## Usage

Aftermath needs to be root, as well as have _full disk access (FDA)_ in order to run. FDA can be granted to the Terminal application in which it is running.

The default usage of Aftermath runs

sudo ./aftermath

To specify certain options

sudo ./aftermath [option1] [option2]

Examples

sudo ./aftermath -o /Users/user/Desktop --deep

sudo ./aftermath --analyze \<path\_to\_collection\_zip\>

## Releases

There is an Aftermath.pkg available under [Releases](https://github.com/jamf/aftermath/releases). This pkg is signed and notarized. It will install the aftermath binary at `/usr/local/bin/`. This would be the ideal way to deploy via MDM. Since this is installed in `bin`, you can then run aftermath like

sudo aftermath [option1] [option2]

## Uninstall

To uninstall the aftermath binary, run the `AftermathUninstaller.pkg` from the [Releases](https://github.com/jamf/aftermath/releases). This will uninstall the binary and also run `aftermath --cleanup` to remove aftermath directories. If any aftermath directories reside elsewhere, from using the `--output` command, it is the responsibility of the user/admin to remove said directories.

## Help Menu

```auto
--analyze -> analyze the results of the Aftermath results
     usage: --analyze <path_to_aftermath_collection_file>
--collect-dirs -> specify locations of (space-separated) directories to dump those raw files
    usage: --collect-dirs <path_to_dir> <path_to_another_dir>
--deep or -d -> perform a deep scan of the file system for modified and accessed timestamped metadata
    WARNING: This will be a time-intensive, memory-consuming scan.
-o or --output -> specify an output location for Aftermath collection results (defaults to /tmp)
     usage: -o Users/user/Desktop
--pretty -> colorize Terminal output
--cleanup -> remove Aftermath folders from default locations ("/tmp", "/var/folders/zz/) 

```

## Contributors

- Stuart Ashenbrenner
- Jaron Bradley
- Maggie Zirnhelt
- Matt Benyo
- Ferdous Saljooki

## Thank You

This project leverages the open source [TrueTree](https://github.com/themittenmac/TrueTree) project, written and [licensed](https://github.com/themittenmac/TrueTree/blob/master/license.md) by Jaron Bradley.

## GitHub:

[https://github.com/jamf/aftermath](https://github.com/jamf/aftermath)