After the release of MacQuisition 2018R1.2, Apple made changes to macOS Mojave. The changes impact how MacQuisition can load the kernel extensions while the operating system is running live, resulting in the error message:
"Memory Access and NTFS write support could not be initialized - possibly due to User-Approved Kernel Extension Loading..."
We are building more support for Mojave in MacQuisition 2019R1, including the ability to capture Mojave RAM live and use the NTFS drivers.
You can still perform a Data Collection with MacQuisition 2018R1.2 while the Mac is running live on Mojave. RAM can be captured if you conduct a soft-boot. Restart the Mac and hold down the option key, then boot into MacQuisition. You will be surprised how much data you can still capture in Mojave RAM from a soft-boot, including passwords.
Note: Soft-booting to MacQuisition 2018R1.2 is supported on 2017 and earlier models.
If you are conducting a Data Collection live on Mojave, go to System Preferences -> Security & Privacy -> Privacy to give 'Full Disk Access' to MacQuisition. Full Disk Access is a new feature for Mojave and giving MacQuisition access is necessary to acquire data from restricted areas.
If you do not have an admin password to give MacQuisition 'Full Disk Access', we recommend booting to MacQuisition instead of running it live. For booting to 2018 Mac Models, go to this article.