LLIMAGER, a macOS acquisition tool developed by e-Forensics Inc., is our go-to solution for Mac forensic imaging. Make it yours!
LLIMAGER was created in response to emerging trends in macOS forensic imaging such as limited "dead box" options, and Apple's macOS security enhancements that tend to restrict access.
It was designed to meet the need for robust and comprehensive forensic imaging of Mac computers, capable of capturing all APFS synthesized volumes; allocated space from HFS+ disks and targeted folders for logical images.
In our experience, we've consciously chosen not to bundle imaging and triage together. This decision came after careful observation and analysis, revealing that triage was utilized in just about 10% of cases. We noticed that the majority of scenarios demanded full processing to yield useful artifacts. By taking this approach, we ensure clients are paying only for the features they truly require.
LLIMAGER is user-friendly and easy enough for entry level digital forensics examiners. The application leverages built-in Mac utilities, providing a versatile solution compatible with a wide range of macOS versions, both past and present. This ensures the tool remains functional across diverse system configurations.