The prohibitory symbol shown in the image below is displayed by macOS when it detects an unsupported boot environment.
When Apple releases new Mac models, the new hardware is built to boot a specific version of macOS or newer. This means each time Apple releases a new Mac model, BlackBag has to build a new boot environment to support the new model.
If you encounter the prohibitory symbol, we recommend checking for a MacQuisition update to make sure you have the most current version installed on your dongle. One way to do this is launch MacQuisition on a Mac connected to the internet. Then click on the [MacQuisition] menu and choose [Check for Updates]. You can also check for the latest version on the Software Downloads page.
What can I do until the new version of MacQuisition is released?
It is still possible to use MacQuisition to create an image or Data Collection on unsupported hardware by using the Target Disk Mode method.
If you are not familiar with Target Disk Mode, Apple has information here.
1- Place the source Mac in Target Disk Mode (TDM) by holding down the option key and then the 'T' key. For the 2018 models, you should see a Thunderbolt and a USB icon appear on the screen.
2- Attach either a Thunderbolt 3 cable, Thunderbolt 2 cable, or a USB 3.0 cable to the source Mac.
3- Boot to MacQuisition on a host Mac that has either a Thunderbolt 3, a Thunderbolt 2, or a USB 3.0 port.
4- Attach the source Mac that is in Target Disk Mode to the host Mac that is booted to MacQuisition.
For 2018 models, we recommend an Apple MQ4H2AM/A USB-C TB3 cable to use between the source Mac in TDM and the host Mac. While they should be stocked in Apple or Best Buy stores, if one of these cables is not available, a 3rd party Thunderbolt (USB-C 3.1 ) or USB-C data cable may work. If an adapter is needed for the source or host port, we recommend only using genuine Apple adapters.
If you are running the host Mac live, the host Mac will need to be running macOS 10.13.6 or newer to detect the 2018 Mac models. If you choose to attach the source Mac in TDM to a live Mac, we highly recommend using SoftBlock or a hardware write-blocker so the source Mac is write-protected.
*NOTE - The 2018 Mac models have a T2 chip with built-in SSD encryption. A physical image of the SSD from a Mac with T2 chip has encryption that is different than FileVault encryption. Since the data from a physical image is outside of its original hardware, the built-in encryption from the T2 chip cannot be decrypted. With versions of MacQuisition prior to 2019R1, examiners are limited to conducting logical acquisitions of Macs with T2 chip while the data is in a decrypted state. We recommend following tips in this blog post to conduct a Data Collection.