Most code was written and will be maintained by Patrick Neumann . Exceptions: /usr/local/bin/kcpass.py: https://github.com/casualscripter/mac-osx-forensics/blob/master/kcpass.py /usr/local/bin/pwdump.py: https://github.com/ict/creddump7 /usr/local/bin/sigfind: https://github.com/sleuthkit/sleuthkit/blob/develop/tools/srchtools/sigfind.cpp with modifications by Rune Nordvik.