MacQuisition™ is a powerful 3-in-1 live data acquisition, targeted data collection, and forensic imaging solution. Tested and used by experienced examiners for over a decade, MacQuisition™ acquires data from over 185 different Macintosh computer models. Avoid complicated and time-consuming take-aparts. MacQuisition™ runs on the Mac OS X operating system and safely boots and collects data from Xserve, Mac, iMac, Mac mini, MacBook, and MacBook Air computers in their own native Mac OS X environment.
Targeted Data Collection
- Target and forensically acquire files, folders, and user directories while avoiding known system files and other unresponsive data.
- Preserve valuable metadata by maintaining its association with the original file.
- Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions.
- Thoroughly log data acquisitions and source device attributes throughout the collection process.
- Selectively acquire email, chat, address book, calendar, and stickies on a per user, per volume basis.
Live Data Acquisition
- Capture important live data such as Internet, chat, and multimedia files in real time.
- Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device.
- Choose from 26 unique system data collection options including active system processes, current system state, and print queue status.
- Extensively log live data acquisition information throughout the collection process
- Avoid time-consuming take-aparts. Use the source machine’s own system to create a forensic image by booting from the MacQuisition USB dongle.
- Image over 185 different Mac laptop, desktop, and OS X server models.
- Write-protect source devices while maintaining read-write access on destination devices.
- Extensively log forensic image acquisition processes, disk and volume attributes, and corresponding hash values.
MacQuisition is a unique forensic imaging and acquisition tool capable of booting hundreds of Mac OS X systems, as well as acquiring live targeted data. As the only forensic solution that runs within a native OS X boot environment, MacQuisition’s compatibility with Mac hardware makes it uniquely versatile and universally reliable.
Below is the range of Mac systems supported by the newest version of MacQuisition, followed by instructions for examiners in need of a solution for older Mac hardware.