Forensics image of ...
 
Notifications
Clear all

Forensics image of APFS

NicolaC88
(@nicolac88)
New Member

Hi to all,

i'm new of this forum, and i have a question. It's my first time on MAC system. One of my client give me a MAC to search some information. Now i've used CAINE with apfs-fuse for mount APFS driver but i don't know how can i made full APFS image. In CAINE i see all files and folder after mounting with apfs-fuse, but when i try to made dd image and try to examine with Vound W4 this give me only hierarchy of folder and not all files. 

Now how can i made full forensics copy of apfs hdd with all information? With CAINE or other linux distro?

Thanks for all information, i'm new of this work and especially on MAC.

Regards

Quote
Topic starter Posted : 11/04/2022 8:02 pm
Topic Tags
Share:
Share to...