In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple’s Gatekeeper defense program at execution time.

This is a known issue when downloading LLIMAGER on a mac using a browser OTHER than Chrome.

To resolve, a) try downloading using Chrome, or b) after unzipping and staging LLIMAGER on the volume, go to Terminal and enter the following command to clear out the extended attributes on the files within "/Volumes/llimager/llimager":

xattr -cr /Volumes/llimager/llimager



Make sure that the volume name of the LLIMAGER's USB Flash/SSD is "llimager'", and that the license key file (llimager.lic) is in the same folder as LLIMAGER:  "/Volumes/llimager/llimager/'"

Yes, LLIMAGER supports the most current M2 chips.
During targeted folders logical imaging, LLIMAGER captures all files in an  unencrypted state. Thus, while logged in as admin user "A", all profile documents in profiles, /users/B, /users/C, etc., are fully accessible and collected in the clear text.
 Attended vs Unattended Mode
LLIMAGER creates two images during the process, a temporary sparse file and the final DMG. When you select "attended" mode, LLIMAGER will pause after creating the sparse file and give you option to stop or proceed, as opposed to "unattended" mode in which it will complete the final DMG image.

Potential Scenario for Attended Mode
When faced with time constraints while imaging many devices onsite, you can stop the process after creating the sparse files. Thereafter, take the sparse file images back to the lab, and run the conversion to DMG and hash option in LLIMAGER
Within 2 hours when received Monday through Friday between 9:00AM and 6:00PM Eastern.
Yes, provided the disk is large enough, you can rely solely on the LLIMAGER disk.
E-mail support@e-forensicsinc.com with the LLIMAGER serial number found on the USB drive from the registered e-mail address, with subject line "LICENSE KEY FILE REQUEST."
​​​​Temporarily disable Gatekeeper before running LLIMAGER. From Terminal, type "sudo spctl --master-disable" and enter. NOTE, be sure to enable after the imaging process with "sudo spctl --master-enable"
"Dead box" imaging refers to the act of booting the computer from a source other than the internal OS and running the imaging from the source. A "live" image is the opposite, whereby one boots from the internal OS and runs the imaging software while logged in. LLIMAGER is a "live" imaging solution.
Yes,  LLIMAGER captures all synthesized APFS volumes.
The best practice for optimal performance is to use two USB disks, one for the sparse image (the LLIMAGER disk), and one for the final converted DMG. This will significantly reduce the time to convert the sparse image to the DMG file.
Simply insert your LLIMAGER USB drive, and download the latest version from here and unzip.
We know losing your LLIMAGER disk can be frustrating, so we will help as quickly as possible.

You have one replacement opportunity per subscription cycle, and there is a $200 fee for the USB SSD/HDD product plus shipping, or $75 for the User-Supplied SSD/HDD software product.

Simply write to "support@e-forensicsinc.com" and provide:

  •  Proof of purchase.
  • LLIMAGER Serial number
We will respond with invoice and payment instructions, and once processed, we will deliver.

This may be caused by anti-virus. Third-party anti-virus should be disabled prior to imaging or in some cases, uninstalled.
Apple has strict controls on the software that can run on the newer versions of macOS, and one of the controls is that software has to be notarized. Apple Software Notarization is a process introduced by Apple to ensure that software distributed outside of the Mac App Store is safe and free from malicious content.

Software that is notarized is prohibited from making calls to some Kernel extensions (Kexts) that are needed for RAM collections.
Yes, you must create your boot environment and it will only work on Intel processors.
LLIMAGER supports full disk acquisition of an APFS (Apple File System) file systems, and allocated space acquisitions of HFS+ (Mac OS Extended) file systems. For non-macOS-native file systems, use targeted disk mode.  

NOTE:
  1. LLIMAGER with APFS:
    • Synthesized Volumes: LLIMAGER captures the entire APFS synthesized volume, which includes all the partitions or volumes within an APFS container. This typically includes the main system volume, a preboot volume, a recovery volume, and a VM (virtual memory) volume.
    • Unallocated Space: LLIMAGER also captures unallocated space within the APFS container. This is because APFS manages space more dynamically compared to HFS+, and the concept of space allocation is different.
  2. LLIMAGER with HFS+:
    • Traditional Volume Structure: HFS+ uses a more traditional volume structure where each partition is distinct and has fixed space allocation.
    • Capturing Unallocated Space: When LLIMAGER is used with HFS+, it generally captures the data within the allocated space of the HFS+ volume. Since HFS+ doesn’t handle space allocation and management in the same way as APFS, the focus is more on the data within the defined partition boundaries, rather than unallocated space.
Therefore, while LLIMAGER captures the entire synthesized disk including unallocated space in APFS, its behavior with HFS+ is more focused on the allocated space and the data within it. This reflects the fundamental differences in how these two file systems are designed and manage disk space.


LLIMAGER is capable of acquiring partitions on external USB hard drives or SSDs, provided they are formatted in file systems that are compatible with macOS. For non-supported file systems, try LLIMAGER in targeted mode.