Mac Forensics

BlackBag Technologies develops industry-leading forensics software and training solutions. This page includes links to our own Mac forensic resources, as well as others that are available on the Web.

Need to acquire a Mac OS X computer? BlackBag makes it easy with two powerful tools, MacQuisition and SoftBlock. MacQuisition is the best solution available for live data acquisition, targeted data collection, and forensic imaging of Mac OS X systems. And SoftBlock capably serves as a software-based forensic write-blocking tool.

Need to analyze a Mac OS X computer? BlackLight is the tool to use.

Mac Forensics


Mac OS X Forensic Tips, Tricks, Tools, and Training

Not sure whether or not a suspect’s Mac is running FileVault 2? Take a look at this blog entry: Using Terminal to Determine if FV2 is Running.

Also, for a step-by-step look at imaging Macs, check out these two entries: Imaging a FileVault 2-Encrypted Volume Using MacQuisition and Imaging a Fusion Drive with FileVault 2 Encryption Using MacQuisition.

Wondering how to image one of the newer MacBooks with only one port? Take a look at this blog entry: The New 2015 MacBook and USB - Target Disk Mode.

Want to learn about some Disk Utility changes in El Capitan? See: Creating a RAID in OS X 10.11 and Restoring Functionality to Disk Utility in OS X 10.11.

Interested in pursuing BlackBag’s Mac and iOS Forensics Certification? Head over to the MiCFE page.



Mac OS X Forensics - Additional Resources