BlackBag Technologies develops industry-leading forensics software and training solutions. This page includes links to our own Mac forensic resources, as well as others that are available on the Web.
Need to acquire a Mac OS X computer? BlackBag makes it easy with two powerful tools, MacQuisition and SoftBlock. MacQuisition is the best solution available for live data acquisition, targeted data collection, and forensic imaging of Mac OS X systems. And SoftBlock capably serves as a software-based forensic write-blocking tool.
Need to analyze a Mac OS X computer? BlackLight is the tool to use.
Mac OS X Forensic Tips, Tricks, Tools, and Training
Not sure whether or not a suspect’s Mac is running FileVault 2? Take a look at this blog entry: Using Terminal to Determine if FV2 is Running.
Also, for a step-by-step look at imaging Macs, check out these two entries: Imaging a FileVault 2-Encrypted Volume Using MacQuisition and Imaging a Fusion Drive with FileVault 2 Encryption Using MacQuisition.
Wondering how to image one of the newer MacBooks with only one port? Take a look at this blog entry: The New 2015 MacBook and USB - Target Disk Mode.
Want to learn about some Disk Utility changes in El Capitan? See: Creating a RAID in OS X 10.11 and Restoring Functionality to Disk Utility in OS X 10.11.
Interested in pursuing BlackBag’s Mac and iOS Forensics Certification? Head over to the MiCFE page.
Mac OS X Forensics - Additional Resources
- Mac Forensics Forum on Yahoo
- Comprehensive Apple Tech Specs
- Apple Security Updates
- Mac and iOS Repair - iFixit
- Carbon Copy Cloner - Backup and Restore Utility
- DiskWarrior - Essential Mac Directory Repair Tool
- MacUpdate - Mac Software Resource
- The Apple Examiner
- Mac OS X Hints