APFS Forensics Image
i am new of this forum, and i have a question. It's my first time on MAC system. One of my client give me a MAC to search some information. Now i've used CAINE with apfs-fuse for mount APFS driver but i don't know how can i made full APFS image. In CAINE i see all files and folder after mounting with apfs-fuse, but when i try to made dd image and try to examine with Vound W4 this give me only hierarchy of folder and not all files.
Now how can i made full forensics copy of apfs hdd with all information? With CAINE or other linux distro?
Thanks for all information, i am new of this work and especially on MAC.