if anybody help me,
I will be happy.
I want to install ftk on mac pc and I want to run FTK on mac pc so I want to get image of it's hard drive..
We do not face with Mac systems, Mostly we face with Windows based computers.
Why run FTK Imager on a Mac? But if you must
For example
FTK Imager 3.1.1 command line
for MAC OS 10.5 AND 10.6X VERSION
on accessdata this is available.
command line versions.
I do not know how to run this.
I am new to Mac systems
They even wrote a handy
Oh Sorry,
You are right.
I did not see it.
Thanks for making me to realize it.
I read it.
I will try.
Is your avatar supposed to be Darth Potato?
Blacklight has mac osx forensics products, and there is also Sumuri. Nuix workstation is great and works on macs, although it is expensive.
For imaging disks on mac osx you can use the terminal. Installing homebrew makes your life easier. You can use your favourite imagers like dcfldd, dc3dd etc. after installing brew.
https://
www.blackbagtech.com/software-products.html
https://sumuri.com
https://www.nuix.com
https://brew.sh
Blacklight has mac osx forensics products, and there is also Sumuri. Nuix workstation is great and works on macs, although it is expensive.
Two main imaging tools worth mentioning
Blackbag Technologies make Macquisition (Blacklight is their examination tool, also good, and can deal with APFS encryption in the application which is handy).
Sumuri make Paladin, which is free, and allow you to boot in and create a dd/e01 image, but won't help if you image is encrypted.
Sumuri also make Recon Imager, which has an MacOS bootable partition with imager and will let you mount the hfs+ volume and decrypt it if you need to.
That being said, I recommend people image both disk0 and the decrypted volume because you can then restore the original drive to an external and boot that on another mac to see how people act.
Otherwise, for live systems, yes FTK Imager has a mac version, but there's always the inbuilt dd command, or you can install ewftools or dc3dd etc.
For the free option, I would get a Paladin disk loaded up
If youve got the cash, recon imager and macquisition are worth it (they're relatively cheap too)
Is your avatar supposed to be Darth Potato?
This is Darth Potato.
Hmmm.
Darth-cat is NOT amused (
jaclaz
I tried like you in the end I bought BlackBag MACQUISITION. It resolved my all problems
Thanks for the Reply.