Insights Blog

New MacQuisition Software Only License

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac systems without having to send MacQuisition hardware to someone’s home. In order to help our customers in this unique time, BlackBag is making a new software only option available to MacQuisition customers for a limited time.  Below we’ve answered some common questions about this new functionality. In addition, we will provide a short, easy to use guide for the person running the application and completing the collection.

What does the MacQuisition Software License Allow?

When running MacQuisition on a machine using the software license, instead of attaching the MacQuisition hardware, users will be able to access the current live mode options.

The first option for collection is to send the new software package to the person who needs to complete the collection and they can run it live on any Mac that needs files extracted. The collection process in this case will involve user interaction to determine the scope of the collection, but our new triage mode makes this easier as they can browse file content or search for keywords to identify needed files.  Alternatively, you can direct them to one of the preconfigured collection options, like collecting the user directory or specific key artifacts to make the collection even easier. These files will then be collected and can be stored in the logical evidence format, preserving key file metadata. The end-user can either email the collected files back or place them on a cloud storage solution such as Dropbox.

If the examiner would like to drive the collection, they will need to connect to the Mac remotely to run the software.  There are several built in options on the Mac to allow remote access, for instance Mac Remote Access or Mac Screen Share, or commercial remote access tools.  For more information on remote access of Mac systems there are helpful suggestion in this article.

To provide this solution to you quickly, we’ve based it on our current release, so it has the same collection functionality that you are used to.

We know that there are many ways we can make this capability even better, so we ask you to continue to provide us feedback and as the demands for remote collections evolve.

How do I Access the Software and License?

To access the software, MacQuisition customers current on SMS can log into their BlackBag web account to download the MacQuisition live DMG and a license key to use until the end of April. You can find the software download and software key under the MacQuisition Software Licenses-> View My License option.

 

You must use this specific software version to access the software license option.

Click the Download MacQuisition Live (.dmg) to download the software.  The license key is visible on the screen under Live Software License, but you can download it in a text file to allow the user to import the license without typing in the key.

You will need to have your MacQuisition device registered to your web account to see the license.  If you see this message you need to register your dongle in order to download the software.

 

When you run the MacQuisition application within the DMG on the remote system the following window will appear. Click Enter License Key

You’ll then be promoted for the Name and License key from the MacQuisition Software License section. You can type in the info or select Load from File.  The license file will be automatically stored in your Downloads folder.  To load from the license file, navigate to your Downloads folder (MacintoshHD/Users/<username>/Downloads) and select the license file.

 

 

Once the license is entered MacQuisition will run and you’ll have all the options available to live mode.

Additional FAQ’s

Does this remote collection mode need internet access?

No, this is an offline solution.

If I have remote access into the target computer, can I run the software remotely and do the collection myself?

Yes, you may use Mac’s screen share or remote access tools to run the software on the remote machine.

What is the cost of the software license?

We are currently providing it free to all MacQuisition customers current on SMS.

How many machines can I collect from? Do I need to use different license keys?

You can run your license key on any system you would like to collect from; for this reason, we ask that you not share the software or license key with others.

Can I get a full disk image with this solution?

No, users will only be able to complete targeted collections as they currently would when running MacQuisition live on the target system.

What will happen after the license expires in April?

BlackBag is committed to supporting our customers and will look at extending the licensing as long as these unusual circumstances continue to affect all of us.

For more information on the latest release of MacQuisition, click here. To see real-world examples of new triaging features in our latest release of MacQuisition, read our blog here.

BlackBag Team
Latest posts by BlackBag Team (see all)