Are you imaging a newer MacBook Pro, MacBook Air, or MacBook with USB-C port? Did MacQuisition start the imaging process and now it appears to be hanging? If yes to both, then we recommend checking the System Time in the Case Details view.
When the battery of a newer Mac laptop depletes, the system time resets to April 1, 1976. Having an incorrect system time can cause MacQuisition to hang while imaging and needs to be adjusted to the current time for the image to complete successfully.
While it may be possible to log in to the Mac and adjust the system time via System Preferences, here are two ways to adjust the system time within MacQuisition:
- If you are using MacQuisition 2020R1:
1- Navigate to the Case Details view
2- If the system time is incorrect, you will see an orange triangle displayed next to the time
3- Click on the Change button (as seen below):
4- Adjust the date and time using the boxes in the Set System Clock window and click Set Time (as seen below):
5- Success! Continue with imaging the Mac
- If you are using MacQuisition 2019R1.2 or older versions of the tool:
1- Go to Tools view and select on Terminal tab
2- Launch the Terminal app
3- Enter the command below following the format with the current date:
4- Success! Continue with imaging the Mac
Note- changing the system time in MacQuisition only impacts dates and times of the MacQuisition log files (i.e. creation time of the image). The actual data contained on disk will not be affected as the volumes are either attached or mounted as read-only.
If your system time is accurate under Case Details view but imaging is still stalling, we recommend trying a different cable and/or a different destination drive. Please contact the tech support team by emailing firstname.lastname@example.org if you need further assistance.
For those that want to create an image while macOS is running live, this article reveals your options.