Maestro Forensic Extends Apple Silicon Support to M5
Maestro Forensic has launched the latest iteration of its “WiSDOM Collector,” a digital evidence acquisition and disk imaging solution now engineered for the newest macOS environments. The update provides critical support for Apple Silicon processors, including the M5 chip, allowing investigators to perform live or power-off data collection across Windows, Linux, and macOS systems.
Navigating Apple’s Evolving Security Architecture
The release addresses the deepening integration of Mac hardware within corporate and public sector environments. According to Maestro Forensic, the software now supports macOS 26 (Tahoe) and the full spectrum of Apple Silicon processors, ranging from the M1 through the M5.
As Apple refines its hardware and operating system security, investigators face mounting pressure to access encrypted or volatile data. WiSDOM Collector bridges this gap by facilitating “live imaging”—capturing memory and running processes while the system remains active—alongside “power-off imaging,” which clones storage devices while the system is dormant.
Automated Artifact Collection
The tool automates the retrieval of over 250 digital artifacts within macOS environments. These include user account information, system and application logs, network configuration data, Spotlight search history, and execution records. By automating these tasks, the software reduces the manual overhead for investigators who might otherwise rely on a patchwork of disparate tools. The platform offers flexible extraction options, ranging from container-based selective extraction for initial incident assessment to full disk imaging for comprehensive analysis.
Evidence Integrity and Workflow Integration
To ensure evidence remains admissible, WiSDOM Collector incorporates automated hashing functions. The software generates MD5, SHA-1, SHA-256, and SHA-512 hash values during the collection process to verify the integrity of the original data.
Collected files are compatible with various forensic formats, including ZIP, AFF4, Sparse Image, and MAEFDB, ensuring seamless integration with existing institutional analysis workflows. Furthermore, data can be imported directly into the MAESTRO WiSDOM macOS analysis platform. This ecosystem allows an investigator to move from initial collection to final report generation within a single, unified environment, which Maestro Forensic states significantly shortens total incident response time.
Combating Modern Cyber Threats
The rise of “Living off the Land” (LotL) attacks and fileless malware has made the capture of volatile memory data essential. Because these threats often leave no trace on a physical disk, the live imaging capabilities of WiSDOM Collector are designed to help security teams identify the root cause of breaches that traditional, static forensic methods might miss.
Maestro Forensic CEO Kim Jong-kwang noted that the ability to rapidly secure evidence is a critical factor in preventing the spread of ransomware and managing legal disputes. The expansion to support the latest Apple hardware is intended to assist forensic professionals and public sector agencies in maintaining incident response efficacy as enterprise technology stacks evolve.