According to different forensics expert forensics tools, the production of an apple device of the forensic image can be complex as surgery, can also be simple, like to drink water to eat before making an apple system overall image, we need to pay attention to the following questions,
1. Apple device models: first confirm the serial number/model, to determine whether the current forensic equipment used the T2 encryption chip technology, whether or not to use the safe startup mode to the possibility of blocking by external devices start
2. The current evidence of apple devices running what file system (HFS + vs APFS)
3. Whether the current evidence on apple devices adopted FileVault2 encryption, whether has obtained the password or key recovery
4. In view of the current apple devices need to mirror the logical access or physical image acquisition
5. Whether apple devices currently adopted the firmware password
6. Whether the current apple devices adopted the hybrid drive
7. Whether you need to obtain image
Equipment for apple to understand and grasp the above problem is necessary, Macquisition, Blackbag company independent research and development of apple devices mirror tool, can help forensic fast answers to most of the problems above, at the same time, whether Macquisition support for apple devices using T2 encryption chip, run what kind of file system, whether there is any FileVault2 encryption and firmware encryption is turned on,

Click https://www.hdw.top/subject/174581570860810865 for more information