After the release of MacQuisition 2019R1.2, Apple made changes to macOS Catalina. The changes impact how MacQuisition can load the kernel extensions while the operating system is running live, resulting in the error message:
"Memory Access and NTFS write support could not be initialized - possibly due to User-Approved Kernel Extension Loading..."
Click on the Cancel button and you can still perform a Data Collection with MacQuisition 2019R1.2 while the Mac is running live on Catalina. RAM can be captured if you conduct a soft-boot. Restart the Mac and hold down the option key, then boot into MacQuisition. You will be surprised how much data you can still capture in Mojave RAM from a soft-boot, including passwords.
Note: For Macs with T2 chip, secure boot settings need to be adjusted in order to soft-boot to MacQuisition.
If you are conducting a Data Collection live on Mojave or Catalina, go to System Preferences -> Security & Privacy -> Privacy to give 'Full Disk Access' to MacQuisition. Allowing Full Disk Access is necessary to acquire data from restricted areas.
If you do not have an admin password to give MacQuisition 'Full Disk Access', we recommend booting to MacQuisition instead of running it live.
*UPDATE: MacQuisition version 2020R1 has more support for Catalina, therefore we recommend updating to 2020R1 to capture Catalina RAM live and use the NTFS drivers.