Skip to Store Area:

You're currently on:

MacQuisition

MacQuisition

Mac OS X


MacQuisition™ is a powerful 3-in-1 live data acquisition, targeted data collection, and forensic imaging solution. Tested and used by experienced Mac forensic examiners for over 7 years, MacQuisition™ acquires data from over 185 different Macintosh computer models. Avoid complicated and time consuming take-aparts. MacQuisition™ runs on the Mac OS X operating system and safely boots and collects data from Xserve, Mac, iMac, Mac Mini, MacBook, and MacBook Air computers in their own native Mac OS X environment.


Note: MacQuisition was designed to acquire data from Macintosh computers running Mac OS X, and does not image iPhone or iPad devices. Please visit our BlackLight forensics software page for more information about acquiring data from iPhone, iPad, and iPod Touch devices.


ADD TO CART REQUEST A QUOTE


Screenshots

Video

MacQuisition Part 1: QuickStart MacQuisition Overview FileVault 2 Encrypted Volumes FileVault 2 Volumes


MacQuisition Dongle   +$0.00
MacQuisition Software   +$0.00

* Required Fields

Price as configured: $1,200.00

Add Items to Cart ADD TO CART

 
 
  Features    Subscriptions and Updates    Compatibility    Boot Instructions    Pricing  

Targeted Data Collection
  • Target and forensically acquire files, folders, and user directories while avoiding known system files and other unresponsive data.
  • Preserve valuable metadata by maintaining its association with the original file.
  • Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions.
  • Thoroughly log data acquisitions and source device attributes throughout the collection process.
  • Selectively acquire email, chat, address book, calendar, and stickies on a per user, per volume basis.
Live Data Acquisition
  • Capture important live data such as Internet, chat, and multimedia files in real time.
  • Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device.
  • Choose from 21 unique system data collection options including active system processes, current system state, and print queue status.
  • Extensively log live data acquisition information throughout the collection process.
Forensic Imaging
  • Avoid time consuming take-aparts. Use the source machine's own system to create a forensic image by booting from the MacQuisition USB swivel key.
  • Image over 185 different Mac laptop, desktop, and OS X server models.
  • Write-protect source devices while maintaining read-write access on destination devices.
  • Extensively log forensic image acquisition processes, disk and volume attributes, and corresponding hash values.


Each new MacQuisition 2013 R1.1 software purchase includes a one-year MacQuisition License Subscription (MLS). During this one-year subscription period, you will have the right to download and install all MacQuisition software updates and new releases. Technical support for all BlackBag products is always available to both current and previous license subscription holders.

Current MacQuisition customers are eligible to purchase MacQuisition 2013 R1.1 at the license subscription rate.

Upgrade MacQuisition

Please fill out the information below, so we may add you to our MacQuisition product update email notification list. Unless you request otherwise, you will only be contacted when new MacQuisition updates and upgrades are available for download.

Name:* Email:* Agency:*

MacQuisition is a unique forensic imaging and acquisition tool capable of booting hundreds of Mac OS X systems, as well as acquiring live targeted data. As the only forensic solution that runs within a native OS X boot environment, MacQuisition's compatibility with Mac hardware makes it uniquely versatile and universally reliable.

Below is the range of Mac systems supported by the newest version of MacQuisition, followed by instructions for examiners in need of a solution for older Mac hardware.

 

Current MacQuisition Release
Date Released
2014 R1 February 11, 2014
 
 
Type
Earliest Compatible System
Most Recent Compatible System
iMac

iMac (Mid 2007)

Model Identifier: iMac7,1

iMac (Late 2013)

Model Identifiers: iMac14,1 / 14,2 / 14,3

Mac mini

Mac mini (Early 2009)

Model Identifier: Macmini3,1

Mac mini (Late 2012)

Model Identifiers: Macmini6,1 / 6,2

Mac Pro

Mac Pro (Early 2008)

Model Identifier: MacPro3,1

Mac Pro (Late 2013)

Model Identifier: MacPro6,1

MacBook

MacBook (Late 2008)

Model Identifier: MacBook5,1

MacBook (Mid 2010)

Model Identifier: MacBook7,1

MacBook Air

MacBook Air (Late 2008)

Model Identifier: MacBookAir2,1

MacBook Air (Mid 2013)

Model Identifiers: MacBookAir6,1 / 6,2

MacBook Pro

MacBook Pro (Mid 2007)

Model Identifier: MacBookPro3,1

MacBook Pro (Late 2013)

Model Identifiers: MacBookPro11,1 / 11,2 / 11,3

Having trouble identifying a Mac OS X system? We recommend the MacTracker App, available for free at the App Store.

 

Legacy Macs

Trouble booting older Mac systems? Within each MacQuisition dongle, there is a legacy version of the software that can boot Intel-based Mac systems that predate the compatibility table above. For even older systems, including those running OS 9 (Classic), all MacQuisition customers have access to an ISO boot disk. ISO downloads are available within MacQuisition customers' individual account pages on BlackBag's website. Please contact support@blackbagtech.com with any questions regarding current compatibility or use of the ISO boot disk.

A forensic examiner can boot from the MacQuisition USB key and image out to an external collection device using the source computer itself. Because MacQuisition boots into a forensically sound environment, no additional write-blocking software or hardware is necessary. The examiner only needs the source computer, a MacQuisition USB key, and a destination collection device to perform this type of static data acquisition.

To boot from the MacQuisition USB key and acquire data from a Mac Pro, MacBook Pro, or MacBook Air computer, with the power off, and the source system plugged into a power source, insert the key into a source system USB port and attach an external collection device.

Press the power button and immediately hold down the Option key. The EFI Boot screen (Startup Manager) appears. 

Click the MacQuisition icon with the MacQuisition version best suited for the source machine hardware, to select it. If you do not know which version you should boot to, please click the compatibility chart tab for further information. Click the arrow below the MacQuisition icon to begin the boot process. The MacQuisition application appears.

If the Apple logo appears, IMMEDIATELY shut the computer down by pressing and holding the power button; the source system is attempting to boot to a drive or other device and not to the MacQuisition key.

The initial software license price for MacQuisition is $1,200 USD (private sector) and $1,000 USD (government). This entitles license holders to all MacQuisition software updates at no additional cost for one year. After the one-year license period has expired, customers may purchase a license subscription for $515 per year to continue receiving all MacQuisition software updates at no additional cost during the one-year subscription period.


Initial Renewal
Private Sector $1,200 $515
Government $1,000 $515


There is no software functionality or customer support penalty if a customer does not renew their MacQuisition license subscription. Our MacQuisition software remains fully functional, and we continue to provide unlimited technical support to our customers even after a MacQuisition license expires. However, customers no longer receive all MacQuisition software updates at no additional cost once their license expires.