Apple made changes to how Fusion is implemented for APFS when they released macOS Mojave. We are building a new solution for APFS Fusion in MacQuisition version 2019R1 (targeted to release end of May 2019).
Currently, it is not possible for MacQuisition 2018R1.2 or any tool we are aware of, to create a physical image of the APFS Fusion synthesized container. It is also not possible to mount the synthesized container while booted to MacQuisition 2018R1.2 to conduct a Data Collection. Below are two other options available at this time.
Option 1 - You can conduct a live Data Collection. If you choose to do this, please follow the tips in this article. Note: The very last tip is important for Mojave; you will need to give MacQuisition 'Full Disk Access' in System Preferences.
Option 2 - You can create physical images of the two physical disks. If you are booted to MacQuisition then you would image disk0 and disk1. It is easiest to image the physical disks as DMG. If you image them as E01, you will need to use current version of EWMounter (included with BlackLight) on Mojave to mount the disk images. Once the images are created, perform the following steps:
1. Using an analysis Mac running macOS Mojave, mount the 2 physical disk images. Mojave can merge the data of the 2 disks and create the APFS Fusion synthesized container.
To mount the DMGs on MacOS Mojave use one of the commands below:
hdiutil attach </PATH/TO/.dmg> -readonly -nomount
hdiutil attach </PATH/TO/.dmg> -blocksize 4096 -readonly -nomount
Note: The second command above includes the block size 4096. Some of the SSDs in the newer iMacs have 4096 block size. Spinning hard drives and earlier SSDs have block size 512 which is the default size in the first command. Use the command with the correct block size for each image you are mounting. Once you successfully mount both images, Mojave should merge them together and present the new APFS synthesized container.
2. Open the Disk Utility app, select the APFS synthesized container and mount it.
3. Once the APFS synthesized container is mounted, you can copy files out to a DMG or drive using Finder or Terminal.
Use BlackLight to process the data from within the mounted APFS synthesized container. BlackLight will not allow you to add the APFS synthesized container as an attached disk. BlackLight will allow you to go a level lower and ingest a folder, for instance the Users directory.