Before You Start
The Mac native Apple Software Restore (ASR) utility is used for the imaging process, thus basically any Mac can be imaged from an admin authenticated session on the Mac computer, and there should be no issues with Apple data encryption, be it FileVault of T2 chipset, or Apple new hardware M1/M2/M3/M4.
The imaging process will first create a sparse image container and use it as the destination of the disk’s image. Once the imaging of the disk has completed, the sparse image will be used to create a compressed read-only DMG file that can be processed with popular forensic and e-discovery pre-processing applications.
The application does not provide an option to encrypt the DMG, as encrypted DMGs are not currently supported by many forensics’ applications.
In the event a DMG image must be securely encrypted, the following options are recommended:
- Usage of a hardware-encrypted external USB disk to save the unencrypted image.
- Encrypt the DMG and place it on a normal unencrypted disk.
- Copy the unencrypted image to a compatible encrypted container on a normal USB disk.
The image format is limited to those used by Apple, in our case, DMG. Other applications can be used to convert the DMG to other formats (e01, …).
Forensic applications change over time, and support for image types may vary. Test the image produced by LLIMAGER 6.0 during the trial period to ensure compatibility with your application(s).