After the release of MacQuisition 2019R1.2, Apple made changes to macOS Catalina. The changes impact how MacQuisition can load the kernel extensions while the operating system is running live, resulting in the error message:
"Memory Access and NTFS write support could not be initialized - possibly due to User-Approved Kernel Extension Loading..."
We are building more support for Catalina in MacQuisition 2019R2, including the ability to capture Mojave RAM live and use the NTFS drivers.
Click on the Cancel button and you can still perform a Data Collection with MacQuisition 2019R1.2 while the Mac is running live on Catalina. RAM can be captured if you conduct a soft-boot. Restart the Mac and hold down the option key, then boot into MacQuisition. You will be surprised how much data you can still capture in Mojave RAM from a soft-boot, including passwords.
Note: For Macs with T2 chip, secure boot settings need to be adjusted in order to soft-boot to MacQuisition.
If you are conducting a Data Collection live on Mojave or Catalina, go to System Preferences -> Security & Privacy -> Privacy to give 'Full Disk Access' to MacQuisition. Allowing Full Disk Access is necessary to acquire data from restricted areas.
If you do not have an admin password to give MacQuisition 'Full Disk Access', we recommend booting to MacQuisition instead of running it live.