by Jade James
MacQuisition is an effective 3-in-1 tool which provides the facility to acquire data live from a running system, as well as offering targeted data collection and forensic imaging. MacQuisition runs on Mac OS X and safely boots and acquires data from over 185 different Macintosh computer models in their native environments, even Fusion Drives. The tool is contained within a 120GB dongle or a 1TB SSD.
Targeted data collection allows you to select and forensically acquire files, folders and user directories whilst avoiding known system files and other unnecessary artifacts. Acquiring live data from a running system allows you to capture valuable data such as internet usage, chats from iMessage, WhatsApp etc. and multimedia files in real time; this would be beneficial in a time sensitive investigation. With MacQuisition you are also able to forensically acquire volatile Random Access Memory. MacQuisition allows you to acquire images in a forensically sound manner and automatically recognises a Fusion drive or if FileVault is present.
