After realizing that there was no free and open source tool for the forensic acquisition of Macs, I decided to create one. This turned out to be a fun learning exercise as well, given that I started with almost zero experience in Mac forensics.
As you know, Macs with Apple Silicon include encryption at the hardware level and analysts cannot use dd or Disk Utility to create full disk images. However there exist native tools (like ASR or Rsync) that can be used to copy existing files, effectively performing a "full file system" image of a Mac computer when it is turned on.
Fuji is an open source program that you can use to acquire a FFS copy of Mac computers, either with ASR or Rsync. The latter is good for selecting a specific folder or working on damaged file systems.
It also comes in handy with macOS 13 Ventura, where ASR is very buggy.
A third "sysdiagnose" mode is about to be added soon. This one does not acquire the file system, but it collects several logs on the target Mac, including unified logs. These also get converted to SQLite for easier parsing.
I would appreciate it if you could test the tool and provide your comments.
Source code repository and releases: GitHub
More information and screenshots: LinkedIn post
