I recommend acquiring a test license of BlackBag (please confirm that tool is APFS compliant).
I own OSForensics, Forensic Explorer and Internet Evidence Finder which might be APFS compliant (I have not had an APFS formatted drive in a case yet), each of the aforementioned tools have worked very well with HFS formatted drives to date.
If you are LE and can provide a download link to the forensic image, I will attempt to carve the deleted user directory for you. If IEF works on your image, I will create a portable case and then deliver the portable case back to you to analyze.
↧