The short answer is.... Apple does not allow this with System Integrity Protection (SIP).
Apple increased security with SIP on macOS High Sierra (10.13), Mojave (10.14) and Catalina (10.15). This prevents access to the OS disk at the root level to create a physical bit-by-bit image.
Examiners have a few options to consider:
1- Boot to MacQuisition, instead of running it live.
2- Place the source Mac in Target Disk Mode and attach it to a host Mac running MacQuisition.
*Important* - If the host Mac is running live, we recommend using SoftBlock or a hardware write-blocker so that the source Mac is attached read-only.
3- Disable SIP on the Mac
Note: Disabling SIP is out of the scope for BlackBag tech support, however, there are many online sources that explain how to disable SIP.
What if the Mac has a T2 chip?
For Macs with a T2 chip, the OS disk needs to be in a read-only state in order for MacQuisition to successfully create a decrypted physical image. This means it will not benefit to disable SIP, the examiner will need to either boot to MacQuisition or use target disk mode.