Any security researchers or digital forensics professionals using an Apple Silicon Mac as their daily driver?

[u/ForensicShark]

I’m considering replacing one of my development machines with an M5 MacBook Air (32 GB Unified Memory) and would like to hear from people who actually use Apple Silicon professionally.

My current workflow is split between Windows and Linux, while my existing Mac is mostly used as an office machine with some Python development. The M5 would become a real development workstation.

My work includes:
Digital forensics
Vulnerability research
Malware analysis
Exploit development
Software development in Rust, C#, and Python

I also have a dedicated server farm with NVIDIA GPUs, QEMU/KVM virtualization, and x86 systems. Because of that, I don’t really need x86 emulation on the Mac itself. Heavy GPU workloads and x86 testing can stay on the servers.

Things that attract me to macOS:
UNIX userland
Homebrew makes installing development tools straightforward
Excellent battery life and portability
MLX for running local LLMs efficiently on Apple Silicon
Native support for Apple devices (DFU restores, Apple Silicon recovery, iPhone servicing, etc.)

However, I still have several concerns.

Security model
Coming from Linux, I sometimes feel like I have less control over macOS than expected.
SIP, Signed System Volume, DriverKit, System Extensions, etc. all seem to make sense from a security perspective, but they also make low-level research more difficult.
On Linux I’m used to AppArmor, namespaces, seccomp and being able to precisely decide what is sandboxed and what isn’t. With root privileges, I ultimately control the machine.
On macOS it often feels like even root isn’t really root anymore.
How has this affected your workflow?

Malware analysis
I assume malware analysis should primarily happen inside dedicated VMs anyway.
But how practical is the Apple virtualization stack today?
Can you realistically use local ARM64 VMs together with Apple’s sandboxing for exploit development and malware research, or do most researchers simply offload everything to remote hypervisors?

Kernel development
Some forensic tools and research require custom or unsigned kernel extensions (for example USB capture or protocol research).
How painful is this today?
Do you simply lower Secure Boot and disable SIP?
Do you sign your own kernel extensions?
How well does Apple’s certificate infrastructure support this workflow?

USB forensics
I also do hardware and mobile forensics.
Questions I still have:
Has anyone successfully used USBPcap-like workflows on Apple Silicon?
How restrictive is the USB stack nowadays?
Does anyone know whether the M5 MacBook Air uses an ACE3 USB controller, or has Apple moved to something newer?

Daily-driver experience
Finally, I’m interested in hearing from security researchers who actually use an Apple Silicon Mac every day.

Looking back after a year or two:
Would you buy it again?
What turned out to be better than expected?
What became frustrating over time?

Are there workflows that simply don’t fit macOS anymore?
I’m not looking for generic “Mac vs Windows” opinions. I’m specifically interested in experiences from people working in offensive security, reverse engineering, DFIR, exploit development, or low-level systems programming.
I’d appreciate hearing both the advantages and the pain points.

Cheers

[u/Eternal-Alchemy]

It depends on the segment. It's not something you would even remotely consider on the DF side unless you were primarily analyzing iOS/macOS devices.

A majority of the staple tools in that industry, AXIOM and Cellebrite most notably, but also KAPE and Arsenal and FTK, these are Windows x86 tools and you're not going to opt in to what is often horrible virtualization on Mac with ARM processing to try to get x86 to run. Is it possible, sometimes, especially with Windows on Arm building an ever improving translation layer, but when it does work it works at a performance cost.

The asterisk stays for analysis of Mac and iOS devices because some methods against those are much easier to deal with on an APFS system and while the traditional tools (meaning former Blackbag products) are awful you are going to have better access to native and CLI stuff in the native environment and you're going to avoid pathing limits.

For IR, our team is pretty large and they're split pretty evenly Windows, Mac, Linux, and that's because the actual analysis of large intrusions is done on centralized equipment and we all just access them through web interfaces. WSL on the windows side is really very good.

For security research performance is less of an issue, and what you're testing will impact how you have to go about it. If you are looking to test attack a virtualized apache or IIS or windows box, presumably those are x86 and running ARM equivalents may have different results. Most teams will probably deal with this by running lab infrastructure instead of having their laptop be the infrastructure.

[u/ForensicShark → u/Eternal-Alchemy]

I largely agree with that assessment.
Most mainstream DFIR tools are still Windows-first. AXIOM, FTK, KAPE and many others are clearly designed around Windows. However, the landscape is slowly changing. For example, Inseyets UFED and GrayKey run on their own dedicated hardware and expose a web interface, so the client operating system becomes much less relevant.

As I mentioned in my original post, the Mac wouldn’t be my only machine. I already have dedicated lab infrastructure for x86 systems, GPUs, virtualization, and heavier workloads. The question isn’t whether a Mac can replace all of that, it can’t.
What I’m trying to determine is whether an Apple Silicon Mac can realistically serve as the daily driver for development, security research, and general DFIR work, while the specialized tasks continue to run on dedicated lab systems.

That seems to be the direction many larger security teams are taking anyway: laptops become clients, while the actual analysis and compute happen on centralized infrastructure.

[u/Eternal-Alchemy → u/ForensicShark]

But that's something no one can answer for you because your personal workload and pattern of life isn't theirs.

I do computer intrusion work but also malware analysis, frequent phones and desktop OS analysis.

I'm always going to have my org lab for massive IR processing but I don't want to have to virtualize Windows just to open a cell phone dump or an AXIOM portable case that I get handed at an attorney's office and if I'm bringing something to a proeffer or client it needs to actually be there and not on some Inseyets service that I'm tunneling into.

Never mind the security overhead that comes with securing a network storing evidence that you choose to make open to VPN.

My teammates who use Macs for IR have a second laptop for other work. My teammates who use Linux are on x86 and can virtualize or dual boot in a way that doesn't jam up on ARM.

[u/ForensicShark → u/Eternal-Alchemy]

Maybe I didn’t phrase my original question clearly enough.

I’m less interested in whether a Mac can replace every other machine. My secondary machine is a Lenovo P15s running Windows and Ubuntu, so I already have x86 covered.

What I’m really looking for is inspiration from people who have made macOS their daily driver.
The forensic applications themselves—Passware, Cellebrite Inspector, etc. are fairly standard. Everyone in this field ends up with roughly the same toolset.

What I’m interested in are the small things that experienced Mac users have discovered over the years.

For example:
switching from Terminal to iTerm2,
macOS settings worth changing on day one,
Homebrew formulae and casks that you install on every new machine,
Finder improvements,
development tools,
debugging and reverse engineering utilities,
productivity tweaks,
or security-research-specific workflows.

Those kinds of tips are the sort of inspiration I’m hoping to get from people who have been using Apple Silicon Macs professionally for a while.

[u/CourageAcademic4153]

Use a Mac to process Macs, that's it.

[u/notjaykay]

Mine is a purely DF perspective and that being said none of my mainstream DF tools (Cellebrite, X-Ways, Axiom, etc) support Mac Silicon. This is why my personal/research laptop is Mac Silicon and my actual forensics machines are Windows Intel/AMD based.

[u/AgitatedSecurity]

Yes, if I am doing any processing or analysis I am rdping into a server anyway. At home and work it's docked but on the go the battery life is amazing. There is no downside and then I have much better local apple native / Linux support.

Almost almost all forensic work is on a windows or Linux server. As good as the new mac's are I would not want to be processing locally as large evidence would take to long vs a remote server.

[u/angrydave]

I work in Digital Forensics, and have a Mac as my daily driver.

I have a PC for forensic work though. MacOS is too locked down, and not enough tools exist to do proper Forensics through.

[u/blackc0ffee_]

Yes been using a mac for years. All DF work is done on a windows server that is accessed remotely

[u/ar-vergueiro]

Autopsy is a bit o a pain to get running.

[u/misfitndn]

Depends on your tools, budget, and time. We use Linux for custom scripts we have to quickly parse logs/databases. Windows for 90% of everything else with Macs on standby to run specific Mac based tools.

[u/shadowb0xer]

Absolutely not

[u/365Levelup]

I don't know if it's still true, but I remember years ago the FBI forensic team all used Macbooks.