Device Agent for Mac Client Tool
This guide walks through installing and running the Mac Device Agent in full detail. If you just need the quick version, the download page has a short numbered list; this page is the extended version with troubleshooting.
What this tool actually does
The Device Agent is a single script — nothing is installed on your Mac, and nothing stays behind afterward. When you run it, it does exactly three things: (1) asks for your case number and shows you which case and client name it found, so you can confirm it's talking to the right case before anything happens; (2) reads a list of the applications currently installed on this Mac (from your Applications folder), plus a few basic system details (computer name, macOS version, hardware model); (3) sends that information directly to your case file, where your investigator can see it immediately. It does not read your files, browsing history, passwords, messages, or anything beyond the installed-application list and the basic system details described above.
Before you start
You'll need: a Mac running a reasonably current version of macOS, an internet connection, and your case number (your investigator will give you this — it looks like 117331-KG44T). No administrator password or installation is required.
Step-by-step
1. Download the file. From the download page, click the download button. The file SwiftDeviceAgent.zip will land in your Downloads folder. It's a zip rather than the script directly because that's what lets macOS preserve the file's "runnable" permission across the download — without it, the browser saves a copy that Finder refuses to run.
2. Extract it. Some browsers (depending on their settings — e.g. Safari's "Open safe files after downloading") unzip it for you automatically the moment it finishes downloading. If you still see SwiftDeviceAgent.zip in your Downloads folder, just double-click it in Finder — macOS's built-in Archive Utility will extract SwiftDeviceAgent.command right next to it.
3. Run it. Double-click the extracted SwiftDeviceAgent.command in Finder. The .command file extension tells macOS to open Terminal and run the script automatically — you don't need to open Terminal yourself or type any commands.
4. If macOS blocks it, you'll see a message that reads exactly: "Apple could not verify 'SwiftDeviceAgent.command' is free of malware that may harm your Mac or compromise your privacy." This is standard Gatekeeper behavior for any script that isn't distributed through a paid Apple Developer account (which internal tools like this one generally aren't) — it is not a sign anything is actually wrong with the file. It can still show up here even though you downloaded a zip: macOS carries the same "downloaded from the internet" flag through to the file it extracts. Two ways past it:
Fastest — Terminal: Press Cmd+Space, type Terminal, press Enter. In the window that opens, type:xattr -d com.apple.quarantine ~/Downloads/SwiftDeviceAgent.command
and press Enter. Then go back and double-click the file again — it will now run normally, with no warning.
No Terminal — System Settings: Go to System Settings → Privacy & Security, scroll down to the Security section, and you'll see a message that the file was blocked with an Open Anyway button. Click it, confirm with your password or Touch ID, then double-click the file again.
5. Enter your case number. A Terminal window opens with a green banner and asks: "Enter your case number." Type it exactly as given to you (letters and numbers, no spaces) and press Enter.
6. Confirm your information. You'll see your name, case number, and case title printed on screen. Double-check this is actually you and your case — if it isn't, close the Terminal window and contact your investigator instead of continuing.
7. Begin the scan. Press Enter again when prompted. You'll see a short sequence: reading system information, then enumerating installed applications (this can take a few seconds if you have a lot of software installed — this is normal, let it finish).
8. Done. You'll see "Report filed successfully" with a count of how many applications were found. That's the whole process — you can close the Terminal window.
Troubleshooting
"Case number not found" — Double check every character, especially the dash and any letters that look similar (0 vs O, 1 vs I). If it still isn't found after a couple tries, contact your investigator to confirm the exact number.
"Could not reach the Swift Investigations portal" — This means your Mac couldn't connect to the internet at that moment. Check your Wi-Fi/network connection and run the script again.
Double-clicking the zip doesn't extract it, or nothing happens — Right-click SwiftDeviceAgent.zip and choose Open With → Archive Utility.
Double-clicking the extracted file just opens it in a text editor instead of running it — Your Mac's file-association settings may have changed. Right-click the file, choose Open With → Terminal instead.
The Terminal command didn't work / "No such file" — Make sure the file is actually in your Downloads folder (some browsers save to a different folder by default). If it's somewhere else, replace ~/Downloads/ in the command with the correct folder path, or just drag the file into the Terminal window right after typing xattr -d com.apple.quarantine (with a trailing space) instead of typing the path by hand.
Privacy note
The information collected here is attached only to your specific case, identified by your case number, and is visible only to your assigned investigator and authorized staff — the same access that already applies to the rest of your case file.