Mac Acquisition Sof...
 
Notifications
Clear all

Mac Acquisition Software

9 Posts
9 Users
0 Reactions
3,423 Views
(@justin-fascetti)
Active Member
Joined: 7 years ago
Posts: 8
Topic starter  

Hello,
I'm wondering if anybody has a suggestion for a good Mac Imaging software? Something free and portable that can run off of an external hard drive, similar to FTK Imager for Mac. Are there any other good software's out there built for creating a forensic image of a Mac machine that meet this criteria?

Thanks!


   
Quote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

OSF Clone


   
ReplyQuote
(@deefir)
Eminent Member
Joined: 6 years ago
Posts: 49
 

Hello,
I'm wondering if anybody has a suggestion for a good Mac Imaging software? Something free and portable that can run off of an external hard drive, similar to FTK Imager for Mac. Are there any other good software's out there built for creating a forensic image of a Mac machine that meet this criteria?

Thanks!

If you're just looking for raw imaging at disk/block level, you could run any live OS from external media.

Do you need to be able to mount encrypted drives with user-provided password and unlock the volume, or are you going to use another product for that?


   
ReplyQuote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

Sumuri Paladin

https://sumuri.com/software/paladin/


   
ReplyQuote
(@randomaccess)
Reputable Member
Joined: 14 years ago
Posts: 385
 

Macquisition or recon imager


   
ReplyQuote
(@blackbag)
New Member
Joined: 14 years ago
Posts: 2
 

If you're interested in learning about MacQuisition, our Mac acquisition software that has the ability to create physical images of Macs with the Apple T2 chip, you can learn more on our website (www.blackbagtech.com) or if you want to reach out to sales@blackbagtech.com they can help you!


   
ReplyQuote
(@eugenebelk)
Active Member
Joined: 6 years ago
Posts: 16
 

The clone of a removed hard drive can be created via Belkasoft Evidence Center. BEC is also capable of decrypting APFS.


   
ReplyQuote
(@hommy0)
Trusted Member
Joined: 15 years ago
Posts: 98
 

I think the questions here are

1) What type of Mac are you trying to acquire?
2) Does it have a T2 chip?
3) Is the Mac live or turned off?

It might be that a free solution is not suitable, and a Paid-For product will be required

Regards


   
ReplyQuote
(@badams)
Active Member
Joined: 6 years ago
Posts: 5
 

I'm late to this, but I've mostly had success with Macquisition. Their tech support is very responsive as well. I just recently reached out to Sumuri for a demo of Recon Imager, but they haven't responded just yet.


   
ReplyQuote
Share: