Forensics image of ...
Clear all

Forensics image of APFS

1 Posts
1 Users
Posts: 1
New Member
Topic starter

Hi to all,

i'm new of this forum, and i have a question. It's my first time on MAC system. One of my client give me a MAC to search some information. Now i've used CAINE with apfs-fuse for mount APFS driver but i don't know how can i made full APFS image. In CAINE i see all files and folder after mounting with apfs-fuse, but when i try to made dd image and try to examine with Vound W4 this give me only hierarchy of folder and not all files. 

Now how can i made full forensics copy of apfs hdd with all information? With CAINE or other linux distro?

Thanks for all information, i'm new of this work and especially on MAC.


Posted : 11/04/2022 8:02 pm