Forensics image of APFS
Hi to all,
i'm new of this forum, and i have a question. It's my first time on MAC system. One of my client give me a MAC to search some information. Now i've used CAINE with apfs-fuse for mount APFS driver but i don't know how can i made full APFS image. In CAINE i see all files and folder after mounting with apfs-fuse, but when i try to made dd image and try to examine with Vound W4 this give me only hierarchy of folder and not all files.
Now how can i made full forensics copy of apfs hdd with all information? With CAINE or other linux distro?
Thanks for all information, i'm new of this work and especially on MAC.