MacQuisition™ is a powerful 3-in-1 live data acquisition, targeted data collection, and forensic imaging solution. Tested and used by experienced Mac forensic examiners for over 7 years, MacQuisition™ acquires data from over 185 different Macintosh computer models. Avoid complicated and time consuming take-aparts. MacQuisition™ runs on the Mac OS X operating system and safely boots and collects data from Xserve, Mac, iMac, Mac Mini, MacBook, and MacBook Air computers in their own native Mac OS X environment.
Targeted Data Collection
- Target and forensically acquire files, folders, and user directories while avoiding known system files and other unresponsive data.
- Preserve valuable metadata by maintaining its association with the original file.
- Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions.
- Thoroughly log data acquisitions and source device attributes throughout the collection process.
- Selectively acquire email, chat, address book, calendar, and stickies on a per user, per volume basis.
Live Data Acquisition
- Capture important live data such as Internet, chat, and multimedia files in real time.
- Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device.
- Choose from 21 unique system data collection options including active system processes, current system state, and print queue status.
- Extensively log live data acquisition information throughout the collection process.
- Avoid time consuming take-aparts. Use the source machine's own system to create a forensic image by booting from the MacQuisition USB swivel key.
- Image over 185 different Mac laptop, desktop, and OS X server models.
- Write-protect source devices while maintaining read-write access on destination devices.
- Extensively log forensic image acquisition processes, disk and volume attributes, and corresponding hash values.