Mac Acquisition Sof...
 
Notifications
Clear all

Mac Acquisition Software  

  RSS
Justin.Fascetti
(@justin-fascetti)
New Member

Hello,
I'm wondering if anybody has a suggestion for a good Mac Imaging software? Something free and portable that can run off of an external hard drive, similar to FTK Imager for Mac. Are there any other good software's out there built for creating a forensic image of a Mac machine that meet this criteria?

Thanks!

Quote
Posted : 04/10/2019 7:19 pm
Igor_Michailov
(@igor_michailov)
Senior Member

OSF Clone

ReplyQuote
Posted : 04/10/2019 7:34 pm
deeFIR
(@deefir)
Junior Member

Hello,
I'm wondering if anybody has a suggestion for a good Mac Imaging software? Something free and portable that can run off of an external hard drive, similar to FTK Imager for Mac. Are there any other good software's out there built for creating a forensic image of a Mac machine that meet this criteria?

Thanks!

If you're just looking for raw imaging at disk/block level, you could run any live OS from external media.

Do you need to be able to mount encrypted drives with user-provided password and unlock the volume, or are you going to use another product for that?

ReplyQuote
Posted : 05/10/2019 5:57 am
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Sumuri Paladin

https://sumuri.com/software/paladin/

ReplyQuote
Posted : 06/10/2019 6:33 pm
randomaccess
(@randomaccess)
Active Member

Macquisition or recon imager

ReplyQuote
Posted : 06/10/2019 11:24 pm
blackbag
(@blackbag)
New Member

If you're interested in learning about MacQuisition, our Mac acquisition software that has the ability to create physical images of Macs with the Apple T2 chip, you can learn more on our website (www.blackbagtech.com) or if you want to reach out to sales@blackbagtech.com they can help you!

ReplyQuote
Posted : 09/10/2019 3:29 pm
EugeneBelk
(@eugenebelk)
New Member

The clone of a removed hard drive can be created via Belkasoft Evidence Center. BEC is also capable of decrypting APFS.

ReplyQuote
Posted : 09/10/2019 4:47 pm
hommy0
(@hommy0)
Member

I think the questions here are

1) What type of Mac are you trying to acquire?
2) Does it have a T2 chip?
3) Is the Mac live or turned off?

It might be that a free solution is not suitable, and a Paid-For product will be required

Regards

ReplyQuote
Posted : 10/10/2019 3:07 pm
badams
(@badams)
New Member

I'm late to this, but I've mostly had success with Macquisition. Their tech support is very responsive as well. I just recently reached out to Sumuri for a demo of Recon Imager, but they haven't responded just yet.

ReplyQuote
Posted : 30/10/2019 6:38 pm
Share: