Straight from the Guru's mouth, Ryan..
They have to be converted to DD or Raw and then add the extension of DMG.. You need Mac OSX 10.7 or higher and it will see it as a special device and rebuild it for you for you reimage.
Basically there nothing on the market beyond blackbag Macquistion that I know of that will image the fusion drive properly..
Also remember to LOCK the DMG so you can't accidentally alter it.
Also learned that Blacklight, which is their forensic tool for Mac will give you the full 6 dates that Mac has. Encase and FTK will only show you the 4 because they do not parse the Plist properly. Nice to have an extra 2 dates sometimes.. Basically if you are doing Apple device forensics, it might be a place to look as this is their niche.
I wish this stuff where much easier sometimes as well.
↧