Full File System

• Make sure all requirements above are met
• Login as an admin into the target Mac computer
• Connect the LLIMAGER drive that contains the copy of the llimager.app and license key file (llimager.lic)
• Connect the destination disk (as needed)
• On your USB SSD, navigate to /llimager and double-click on “llimager.app” and once it launches, enter a local admin password and click the button.

• On your USB SSD, navigate to /llimager and double-click on “llimager.app” and once it launches, enter a local admin password.

• Make sure to review the "Best Practices Checklist" and click OK when done. Then select the type of image you want to make

LLIMAGER Menu Options

Full File System

This option is equivalent to a full file system and allows the entire process of imaging the computer’s hard disk volumes’ active space, saving the image to a Mac sparse image container and then conversion of the image to a compressed DMG file, and calculating the hash value of the DMG file. During the process, there will be an option to fully automate the process by creating the final DMG or to just generate the sparse file.

Targeted

This option allows the imaging of targeted files/folders on the computer’s hard disk, saving the image to a compressed read-only DMG file, and calculating the hash value of the DMG file. It includes granular selection of documents and folders based on custom file types (extensions) and file system dates such as the birth time (creation), modified, accessed and the change time (inode delta). Moreover, profiles are available to save selections for future jobs.

Time Machine

A Time Machine-based disk image of the near-full data volume, including Trash folders, can be created using this feature. Unlike standard Time Machine backups, LLIMAGER 6.0 includes all Trash folders, which are typically excluded, and packages the image into a single DMG file. Note, Time Machine omits specific system, log, and cache files, thus this option is better suited for e-discovery rather than digital forensics workflows.

Convert/ Hash

This option allows the process of converting a sparse image file to a compressed DMG file, and to calculate the hash value of the DMG file.

Send to Cloud

Allows uploading of images to AWS, Google Cloud or Microsoft Azure using authentication keys and giving option to securely saving credentials for future uploads. Note, you can preview the upload speed on the environment where the upload process will be occurring.

User Profiles

This option allows the imaging of targeted user profile(s), saving the image to a ZIP or DMG file, and calculating the hash value.

Exit

This option will exit the application.

Creating Evidence files

The core workflow of the LLIMAGER app encompasses evidence capture, DMG file generation, and the creation of a signed, tamper-protected PDF log.

---

Before You Begin

• Confirm you are logged in the target Mac computer with valid local admin credentials
• Make sure you have enabled full disk access for the LLIMAGER app
• Follow the sequence shown in the video below.

---

Step-by-Step Walkthrough (Full File System Aquisitions)

Step 1 — Start a New Acquisition

1. As shown in the video above, click the Full File System icon.
2. The evidence creation form for Full File System images will open.

Step 2 — Fill in Evidence Metadata

Field	Description	Required
Case	Your organization's case name	No
Evidence	Unique evidence item identifier	No
Agent	Name of collecting officer / agent	No
Case ID	Your organization's case identifier	No
Notes	Additional context or observations	No

Step 3 — Attach Evidence Files

Identify and input information about the device to be imaged, and the destination USBs where the image will be saved (see figure below). Additionally, provide information related to the case, name of the image and folders to use to save the file, select to convert or not to DMG, and choose to hash, and type of hash. The following picture shows the requested information.

See the description below of each section.

A – Related to the image. Name assigned to the image files (sparse and DMG)

B - Related to the case. Case name, evidence number, agent, case ID and notes.

C – Related to the device to be imaged. Requires the selection of the device ID to be imaged. The app will verify the device and display the volume name, and the GB size of the device.

D – Related to the destination of the sparse image and DMG file. Requires the selection of the USB label (partition) to be used to save the files. The app will verify the device and display the device ID.

E – Select to convert or not to DMG, and to save to the same disk as the sparse or to a different disk.

F – Related to hashing of the DMG file. Specify if hashing should be done and type.

G – Option to collect macOS sysdiagnose.

Note, there are power saving settings on the computer that may interfere and break the imaging process, these settings are temporarily disabled during the image.

1. Enter an Image Name (do not use spaces).
2. Select Image Type: For a system disk (most common), ensure "Live Image" is checked. It is enabled by default.
3. Select destination path.
4. Select the DMG Path if a different location is required.
5. Click Review to verify the collection settings.
6. Review the Configuration: When the form opens, verify the data. Click Process Image to proceed, or Review to make modifications.
7. Start Processing: In the Process Image view, click Process. Note that completion time depends on the image size.

Note: If the Process Image button is disabled, a warning message will indicate the required corrections (e.g., invalid name or insufficient disk space).

After completing the selections, click on Review and a summary of the information provided will be displayed. See the following picture:

After validating and accepting the information, click on “Create Image” and the following will appear:

Click on “Click to start process” and as the process commences, a progress screen indicating that the sparse image is being generated will appear -- see below:

Once the sparse image is completed, if “Convert to DMG” was selected, LLIMAGER will proceed to create the DMG. After the DMG conversion is completed, LLIMAGER will proceed to hash the DMG if “Hash file” was selected -- see below: