MacLockPick 3™ is an indispensable tool designed for first responders and law enforcement professionals performing live incident response on most computer systems. The solution is based on a USB flash drive that is inserted into a suspect’s computer running Mac OS X, Microsoft Windows, or Linux.
MacLockPick is easy to use. With one click, MacLockPick will quickly extract the requisite data, providing the examiner fast access to the suspect’s critical information that may otherwise be rendered unreadable by modern encryption programs, hardware malfunctions, or simply powering the system down. MacLockPick is the best cross-platform solution on the market and offers an investigator the best chance of successfully capturing important data from running computers. In addition, MacLockPick is minimally intrusive and functions in a forensically sound manner, providing results that can hold up in a court of law.
Despite the simple interface, MacLockPick is extremely flexible. Through the use of a plug-in architecture, MacLockPick can be configured to collect almost any kind of information depending on the needs of the investigator. This information might include files of a specific type, chat logs, iPhone™ and iPad™ records, browser history, passwords, accounts, and more.
MacLockPick allows the user to create custom plug-ins to copy specific files or folders on a suspect system, run a terminal line command and record the results, or execute custom CLIs (command-line interface). The ability to allow custom plug-ins makes MacLockPick an even more powerful tool for any digital forensics and eDiscovery needs.
The following is a short list of some of the information that can be extracted using MacLockPick 3:
- Apple and Windows passwords*.
- iPhone and iPad information including call logs & SMS history, web browsing history, pictures, contact information, and email.
- Firefox, Internet Explorer, Google Chrome, and Safari web browsing history, bookmarks, and caches.
- Instant messaging logs.
- iPod and Bluetooth device information.
- Cached traces of social networking activity stored by Apple Safari on Mac OS X.
- System information such as username, serial number, model, processes and OS version.
- Registry settings.
- USB flash drive history.
- Extract iPhoto information based on specific filters.
- Network information including as IP address, ARP tables, DNS dump, WiFi connections, and network interface.
What’s new in MacLockPick 3.0
- Extract iPhoto information based on camera type with filters for meta data and file filters
- Upgraded iPhone, iPad, iOS, and Mac OS X Lion support
- Upgraded plugin application support
- Increased speed in processing suspect machines
- Additional focus on Apple technologies
- User selectable order of plugin execution
- Mac based on Intel processor running OS X 10.5 or higher
- Windows XP, Vista, or 7
- Second hard disk for storing data recommended
- USB port for USB license dongle (supplied with MacLockPick)
Note: Due to a change in macOS 10.12 and above, MacLockPick will no long recover keychain’s passwords. In addition, MacLockPick is currently a 32-bit app, and may not work with future versions of macOS that may require 64-bit app to run properly. No update is currently planned.