Imaging APFS - A Walkthrough for Starting Forensics on MacOS

Here to demystify the imaging process for computers and devices using APFS is SEVN-X's Chief Strategist Matt Barnett.

Tools used in this process (Affiliate Links)

Docking Station
Disk Drive Reader
1Tb Western Digital Hard Drive
USB-C Cable

Blog Post

[CRK]

For the dd command, you can use "status=progress" option to see the running static.

[forpaqk]

Excellent presentation, informative and captivating.

[msewhisperer]

Are the steps you mention in this video the same for a mac mini?

[阿提蒙]

great sharing, thanks!
i have a question, if diskutil is not available while disable disk arbitration, how can we determine which disk is our target disk(synthesized) after connect?

[ParallaxVisuals]

hello! this might be a long shot but here it is.
I have s Seagate backup plus 4tb external hard drive APFS encrypted.
I've set a password on it years ago, the password got saved in my local keychain so i never had to type it.
When I say I've set a password i mean a looong one (was watching a lot of Snowden documentaries at the time)
fast forward 4 years, i had to format my macbook due to an issue.
I didn't know at the time that there is a local keychain, i thought it's all on iCloud.
long story short, lost the password to the external hdd.I have A LOT of family photos/videos in there as it was my main backup drive....
What are the cances I can recover the password?

[LouRC]

Why is there music in the background. Any way to turn it off? I have my own radio.

[luxmunk]

Very interesting vid. Forgive my ignorance about forensics, but what is an example of when you’d use this?
Is this how one could image an entire Mac? I ask because of the reference you made to the long wait time for completion when you were only handling 1mg. What about 1gb? Or 1tb?

I often have such a need when cloning failing harddrives while still installed in the Mac. In the past couple years, I’d pretty much abandoned this method for accessing drives. I was losing faith in Target Disk Mode as a once-go to tool for all kinds of Mac repairs.

PS the distinction between an actual Thunderbolt 3 vs a USB-c is a detail I would have taken years of trial and error to discover. Such a beneficial tip.

I own an Independent Apple Service shop. Thanks.

[davidpoole]

Very nice how-to. What happens if the device employees the T2 chipset with or without FileVault2?

[inwerp]

It wont really work that way on m1+ macs sine they use virtual network device as a target disk.

[johnhanley]

You are a good speaker. However, the music really distracts from following you. For example, when I try to watch on my iPhone with earbuds, the music is too loud and I have to replay sections to hear your words. On my desktop the music is not so loud, but the music is still too distracting. Remove the background music.

[sanjeevgoel]

For god sake, remove the music in your videos. It is really annoying.

[inwerp]

I revisited this video and I must point out a very big mistake.
Imaging virtual synthesed disk won't make a proper image. It is quite trivial to write data to EFI partition which is not even listed in your dev3. Efi partition also contains some boot logs which are also obviously a part of forensics research.

[minorukobayashi]

This method should not work on M1 Mac. This is because there is no target disk mode.

[IlCapodeiCapiTheBoss]

this doesn't seems to work with FV2 /encrypted disk, cause the output is pretty much blank? any solution please? cause cannot unencrypted without mounting/ diskarbritation
and needed a thunderbolt to work @sevnxsecurity