BlackBag Technologies Help Center home page


Contact Support

Articles in this section

Creating a physical decrypted image of Mac with T2 chip

Support Team
  • Updated
Follow

MacQuisition 2019 R1.2 has the ability to create a physical decrypted image of a Mac with T2 chip in 5 steps. 

NOTE:  Apple explains more about the T2 security chip here. T2 chip encryption (hardware) is separate from FileVault encryption (software). You do NOT need the user's password for MacQuisition to decrypt T2 chip encryption. However, if FileVault (FV) encryption is turned on, you DO need either the FV password or FV recovery key in order for MacQuisition to be able to decrypt the FV encrypted data. 

STEP 1: Handle secure boot settings

When a Mac with a T2 chip is sold by Apple, the secure boot settings 'Full Security' and 'Disallow booting from external media' are enabled by default. This prevents an examiner from being able to boot to external media such as MacQuisition. It is possible to change the secure boot settings by following the instructions below and entering an admin password. If you do not have the password for an admin user account, you can use the workaround in this article Imaging a Mac via Target Disk Mode. 

Secure Boot settings are available in the Startup Security Utility:

  1. Turn on the Mac, then press and hold Command (⌘)+ R immediately to start up from macOS Recovery.
  2. When you see the macOS Utilities window, choose Utilities > 'Startup Security Utility' from the menu bar.
  3. When you're asked to authenticate, click Enter macOS Password, then choose an administrator account and enter its password.

In order to boot to MacQuisition or other external media, the secure boot settings need to be changed to 'No Security' and 'Allow booting from external media'. 

SecureBootSettings.png​

IMPORTANT: If you want to change the secure boot setting back from 'No Security' to 'Full Security' Apple requires an internet connection. 

STEP 2: Boot to MacQuisition 2019 R1.2
 
The OS disk needs to be in read-only state to create a physical decrypted image. If you run MacQuisition live, the OS disk is mounted read/write, which may result in a corrupt image. 
 
STEP 3: Click on Image Device view
 
Even if FileVault encryption is turned on, go to Image Device view. For Macs with T2 chip, MacQuisition 2019 R1.2 is designed to unlock FV from Image Device view, not Tools view. 
 
STEP 4: Select image options
 
Choose an AFF4 format, destination location, and highlight the APFS Container (usually disk1).  
 
Screen_Shot_2019-10-13_at_2.18.19_PM.png
 
NOTE: If the Mac has a Boot Camp partition, you will need to image that partition separately. 
 
STEP 5: Click on Image Device button
 
If the Mac has FileVault encryption, MacQuisition will prompt at this time to enter either a FV password or FV recovery key.
 
Currently, unlocking FV with Institutional recovery key is not supported for physical decrypted images. If you only have a FV master keychain, we recommend unlocking FV in Tools > Mount Device view and performing a logical Data Collection. 
 
MORE INFORMATION: 
 
The MacQuisition User Guide provides more information starting on page 103.
 
BlackLight 2019 R1 and newer can process MacQuisition created AFF4 images. As of October 2019, we are not aware of a tool that can convert an AFF4 image to a different format. There are other tools that support a MacQuisition created AFF4 image. Arsenal Mounter can mount an AFF4 image on Windows OS. 
 

Related articles