MacQuisition is a powerful, 3-in-1 solution for live data acquisition, targeted data collection, and forensic imaging. Tested and used by experienced examiners for over a decade, MacQuisition runs on the Mac OS X operating system and safely boots and acquires data from over 185 different Macintosh computer models in their native environment – even Fusion Drives. There’s no need for complicated take-aparts when you’ve got MacQuisition.

FEATURES

TARGETED DATA COLLECTION

SELECTIVELY ACQUIRE

  • Target and forensically acquire files, folders, and user directories while avoiding known system files and other unneeded data
  • Preserve valuable metadata by maintaining its association with the original file
  • Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions
  • Thoroughly log data acquisitions and source device attributes throughout the collection process
  • Selectively acquire email, chat, address book, Calendar, and other data on a per-user, per-volume basis

LIVE DATA ACQUISITION

COLLECT FROM LIVE SYSTEMS

  • Capture important live data such as Internet, chat, and multimedia files in real time
  • Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device
  • Choose from 26 unique system data collection options, including active system processes, current system state, and print queue status
  • Extensively log live data acquisition information throughout the collection process

FORENSIC IMAGING

CREATE FORENSIC IMAGES

  • MacQuisition automatically recognizes a combined volume from a Fusion Driveand presents it for imaging
  • If FileVault 2 exists, the examiner can, with use of the password, Keychain file or recovery key, mount the volume in a read-only fashion, allowing for either a triage or collection of the files
  • Use the source machine’s own system to create a forensic image by booting from the MacQuisition USB dongle
  • Write-protect source devices while maintaining read-write access on destination devices

Please contact CDFS for more information
1300 55 33 24 | E-mail: contact@cdfs.com.au

2017-09-01T14:51:30+00:00