MacQuisition Compatibility & Requirements

Device Compatibility

MacQuisition is a unique forensic imaging and acquisition tool capable of booting hundreds of Mac OS X systems, as well as acquiring live targeted data. MacQuisition is the trusted forensic solution that runs within a native OS X boot environment.

Below is the range of Mac systems supported by the newest version of MacQuisition, followed by instructions for examiners in need of a solution for older Mac hardware. For Mac models with a USB-C port, we advise using an Apple USB-C adapter. Other third party USB-C accessories may not be compatible.

*Note: Not all recent systems have been fully tested. The compatibility table represents the full list of systems that MacQuisition is built to support. If you have any issues with system compatibility, please contact our Support Team.

Current MacQuisition Release Date Released
2020 R1 February 20, 2020

 

Type Earliest Compatible System* Most Recent Compatible System
iMac iMac (Late 2012)
Model Identifier: iMac13,1 / 13,2
iMac (2019)
Model Identifiers: iMac19,1 / 19,2
iMac Pro iMac Pro (Late 2017)
Model Identifier: iMacPro1,1†
iMac Pro (Late 2017)
Model Identifier: iMacPro1,1†
Mac mini Mac mini (Late 2012)
Model Identifier: Macmini6,1 / 6,2
Mac mini (Late 2018)
Model Identifiers: Macmini8,1
Mac Pro Mac Pro (Late 2013)
Model Identifier: MacPro6,1
Mac Pro (2019)
Model Identifier: MacPro7,1
MacBook MacBook (Early 2015)
Model Identifier: MacBook8,1
MacBook (Mid 2017)
Model Identifier: MacBook10,1
MacBook Air MacBook Air (Mid 2012)
Model Identifier: MacBookAir5,1 / 5,2
MacBook Air (2019)
Model Identifiers: MacBookAir8,2
MacBook Pro MacBook Pro (Mid 2012)
Model Identifier: MacBookPro9,1 / 9,2
MacBook Pro (2019)
Model Identifiers: MacBookPro16,1

* Certain older models that are not supported by the MacQuisition 2020 R1 partition may be bootable by other MacQuisition boot partitions. Having trouble identifying a Mac OS X system? We recommend the MacTracker App, available for free at the App Store.

† T2 chip default encryption may be present.

Legacy Macs

Trouble booting older Mac systems? Within each MacQuisition dongle, there is a legacy version of the software that can boot Intel-based Mac systems that predate the compatibility table above. For even older systems, including those running OS 9 (Classic), all MacQuisition customers have access to an ISO boot disk. ISO downloads are available within MacQuisition customers’ individual account pages on BlackBag’s website. Please contact support@blackbagtech.com with any questions regarding current compatibility or use of the ISO boot disk.

Boot Instructions

A forensic examiner can boot from the MacQuisition USB dongle and image out to an external collection device using the source computer itself. Because MacQuisition boots into a forensically sound environment, no additional write-blocking software or hardware is necessary. The examiner only needs the source computer, a MacQuisition USB dongle, and a destination collection device to perform this type of static data acquisition.

To boot from the MacQuisition USB dongle and acquire data from a Mac Pro, MacBook Pro, or MacBook Air computer, with the power off, and the source system plugged into a power source, insert the USB dongle into a source system USB port and attach an external collection device.

Press the power button and immediately hold down the Option key. The EFI Boot screen (Startup Manager) appears.

Click the MacQuisition icon with the MacQuisition version best suited for the source machine hardware. If you do not know which version you should boot to, check the device compatibility section for further information. Click the arrow below the MacQuisition icon to begin the boot process.

The BlackBag logo appears, and shortly after that, a thin progress bar appears beneath the logo. Next, depending on the hardware model and date of manufacture, the Apple logo may appear for approximately 5-10 seconds. Lastly, the MacQuisition splash screen appears, followed by the EULA.

Important: If the Apple logo appears before the BlackBag logo, IMMEDIATELY shut down the computer by pressing and holding the power button – the source system is attempting to boot to a drive or other device, and not to the MacQuisition dongle.

If a gray screen with a slashed circle appears, shut down the system by pressing and holding the power button, and boot the system to the ‘MacQuisition Legacy’ partition.

Release Notes

Our latest release, MacQuisition™ 2020 R1, includes:

  • Triage before collection in both live and booted mode
  • New Browser View to preview file content prior to acquisition
  • New Search View to locate files using filters or keywords before acquisition
  • While triaging in the Browser and Search views, files and folders can be added to the data collection
  • Ability to stored data collection in the .L01 logical evidence file format
  • Added capabilities to decrypt unallocated space on T2 drives
  • Added hashing for AFF4 images as the data is collected
  • Restructured MacQuisition log files
  • Capture RAM and targeted collections live on macOS 10.15 (Catalina)
  • Support added to boot newer hardware

Key features of MacQuisition™ 2019 R1.2, includes:

  • Fixed booting on T2 Macs, previously was booting to internal Recovery partition
  • Fixed Target Disk Mode on MacBook Pro 2018 systems that previously resulted in error message
  • Ability to create physical images of Macs with the Apple T2 chip
  • Support for imaging APFS Fusion drives
  • Capture RAM and targeted collections live on Mojave
  • Support added to boot newer hardware

Pricing

Each new MacQuisition™ license purchase includes one-year Software Maintenance Support (SMS). Customers current on SMS receive all MacQuisition™ software updates and technical support. Customers may purchase an extension of SMS each year to continue receiving SMS benefits. Customers will still be able to use the MacQuisition™ updates released during their support period when their license expires.