MacQuisition is an extremely effective, 3-in-1 solution for live data acquisition, deep data collection, and instant forensic imaging. Tested and used by experienced users for over a decade, MacQuisition runs on the Mac OS X operating system and safely boots and acquires data from over 185 different Macintosh computer models in their native environment - even Fusion Drives. There’s no need for extra and complicated plug-ins with this product.
Here are the main features of BlackBag Macquisition:
- Eagle eyed data collection: You can personally target and forensically acquire files, folders, and user directories while avoiding known system files and other redundant data. This product allows you to preserve valuable metadata by maintaining its association with the original file, including a feature for you to authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions.
- Live Data Acquisition: You can capture important live data such as internet application services, chats, and multimedia files in real time. It allows you to smoothly acquire and save volatile and discrete Random Access Memory (RAM) contents to a destination device, whatever it might be. Macquisition offers you to choose from 26 unique system data collection options, including active system processes, current system state, and print queue statuses.
- Forensic Imaging: MacQuisition automatically recognizes a combined volume from a Fusion Drive and presents it for imaging. If FileVault 2 exists, the examiner can, with the use of the passcode, Keychain file or recovery key, mount the volume in a read-only fashion, allowing for either a triage or collection of files. It allows you to use the source machine's own system to create a forensic image by booting from the MacQuisition USB dongle.