April 17, 2023, 9:17 p.m. | /u/matt_smith2456

Computer Forensics www.reddit.com

Attempting to image a M1 MacBook Air (valid login, FileValt not enabled). Exterro support suggsedted using DD from recovery menu to take the image. I used DD to take images of all the drives, but FTK Toolkit doese not recognize the APFS container. Support suggested changing DD to E01, but no good. Now suport said that DD may not be supported and I should take a logical image.

Is there any way to view the DD image in FTK v7.6? …

apfs changing computerforensics container drives exterro images login macbook macbook air may recovery support toolkit valid

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Cloud Security Engineer

@ Gainwell Technologies | Any city, OR, US, 99999

Federal Workday Security Lead

@ Accenture Federal Services | Arlington, VA

Workplace Consultant

@ Solvinity | Den Bosch, Noord-Brabant, Nederland

SrMgr-Global Information Security - Security Risk Management

@ Marriott International | Bethesda, MD, United States

Sr. Security Engineer - Data Loss Prevention

@ Verisk | Jersey City, NJ, United States