The short answer is.... Apple does not allow this with System Integrity Protection (SIP).
Apple increased security with SIP on macOS High Sierra (10.13), Mojave (10.14) and Catalina (10.15). This prevents access to the OS disk at the root level to create a physical bit-by-bit image.
Examiners have a few options to consider:
1- Boot to MacQuisition, instead of running it live.
2- Place the source Mac in Target Disk Mode and attach to a host Mac running MacQuisition.
*Important* - If the host Mac is running live, we recommend using SoftBlock or a hardware write-blocker so that the source Mac is attached read-only.
3- Disable SIP on the Mac
Note: Disabling SIP is out of the scope for BlackBag tech support, however there are many online sources that explain how to disable SIP.