Mac
forensic imaging

This is a known quarantine issue when downloading LLIMAGER on a mac. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple’s Gatekeeper defense program at execution time.

TO RESOLVE:

USER-SUPPLIED SSD/HDD VERSION:

1) PROPERLY SETUP YOUR USB SSD/HDD: FORMAT TWO PARTITIONS NAMED, "llimager" and "llidata" IN exFAT. NOTE: THE "llimager" PARTITION IS FOR THE EXECUTABLE, AND CAN BE VERY SMALL (~2-10GB), WHILE THE REMAINING SPACE SHOULD BE  USED FOR THE "llidata" PARTITION TO STORE IMAGES. MAKE SURE TO CREATE A FOLDER NAMED "/llimager" IN THE "llimager" PARTITION.

2) DOWNLOAD LLIMAGER:  DOWNLOAD THE LLIMAGER ZIP FILE USING A WINDOWS COMPUTER AND UNZIP CONTENTS (llimager.app and llimager-manual.pdf) INTO THE "llimager" FOLDER WHILE IN WINDOWS.

HARDWARE VERSION:

1) INSERT THE LLIMAGER SSD/HDD INTO A WINDOWS COMPUTER.

2) DOWNLOAD THE LLIMAGER ZIP FILE AND UNZIP CONTENTS (llimager.app and llimager-manual.pdf) INTO THE "llimager" FOLDER WHILE IN WINDOWS.

Make sure that the volume name of the LLIMAGER's USB Flash/SSD is "llimager'", and that the license key file (llimager.lic) is in the same folder as LLIMAGER:  "/Volumes/llimager/llimager/'"

Yes, LLIMAGER supports M1, M2, M3 and M4 chips.

During targeted folders logical imaging, LLIMAGER captures all files in an  unencrypted state provided each user account is logged in the background. Thus, while logged in as admin user "A", all profile documents in profiles, /users/B, /users/C, etc., are fully accessible and collected in the clear text.

 Attended vs Unattended Mode
LLIMAGER creates two images during the process, a temporary sparse file and the final DMG. In version 3.x, when you select "attended" mode, LLIMAGER will pause after creating the sparse file and give you option to stop or proceed, as opposed to "unattended" mode in which it will complete the final DMG image.

Potential Scenario for Attended Mode
When faced with time constraints while imaging many devices onsite, you can stop the process after creating the sparse files. Thereafter, take the sparse file images back to the lab, and run the conversion to DMG and hash option in LLIMAGER. 

Within 2 hours when received Monday through Friday between 9:00AM and 6:00PM Eastern.

Yes, provided the disk is large enough, you can rely solely on the LLIMAGER disk.

E-mail support@e-forensicsinc.com with the LLIMAGER serial number found on the USB drive from the registered e-mail address, with subject line "LICENSE KEY FILE REQUEST."

​​​​Temporarily disable Gatekeeper before running LLIMAGER. From Terminal, type "sudo spctl --master-disable" and enter. NOTE, be sure to enable after the imaging process with "sudo spctl --master-enable"

"Dead box" imaging refers to the act of booting the computer from a source other than the internal OS and running the imaging from the source. A "live" image is the opposite, whereby one boots from the internal OS and runs the imaging software while logged in. LLIMAGER is a "live" imaging solution,  yet "dead box" imaging can be done on Intel Macs provided the user builds a bootable macOS environment -- refer to FAQ #17.

Yes,  LLIMAGER captures all synthesized APFS volumes.

The best practice for optimal performance is to use two USB disks, one for the sparse image (the LLIMAGER disk), and one for the final converted DMG. This will significantly reduce the time to convert the sparse image to the DMG file.

Simply insert your LLIMAGER USB drive, and download the latest version from here.

We know losing your LLIMAGER disk can be frustrating, so we will help as quickly as possible.

You have one replacement opportunity per subscription cycle, and there is a $200 fee for the USB SSD/HDD product plus shipping, or $75 for the User-Supplied SSD/HDD software product.

Simply write to "support@e-forensicsinc.com" and provide:

• Proof of purchase.
• LLIMAGER Serial number.

We will respond with:

• a Statement of Truth document for execution
• Invoice, and 
• Payment instructions

Once processed, the replacement will be e-mailed/shipped.

This may be caused by anti-virus. Third-party anti-virus should be disabled prior to imaging or in some cases, uninstalled.

Other possibilities include: a) file system errors (dirty volume) in which case you need to run First Aid, b) outdated macOS version in which case upgrading to a more current version may resolve or c) communication issues with destination disk.

Apple has strict controls on the software that can run on the newer versions of macOS, and one of the controls is that software has to be notarized. Apple Software Notarization is a process introduced by Apple to ensure that software distributed outside of the Mac App Store is safe and free from malicious content.

Software that is notarized is prohibited from making calls to some Kernel extensions (Kexts) that are needed for RAM collections.

Yes, however, you must create your boot environment and it will only work on Intel processors; see workflows below.

User-Supplied LLIMAGER version:

After obtaining the license key for the USB SSD disk provided, use the same disk and insert into a Mac to create a minimum of two partitions: one small (~40GB) for the bootable macOS environment, and one small (~20GB: ex-FAT recommended ) to hold the LLIMAGER executable and license key file. A third optional one would be a large one (remaining space: ex-FAT recommended) for storage, which we typically name, "LLIDATA" to hold sparsefiles and DMG images. See "Create a bootable macOS environment partition to boot from a USB " below for instructions on creating the bootable macOS environment.


After the disk volumes are in place, and you've copied LLIMAGER and license key file onto the volume/folder (/LLIMAGER/llimager), you can boot the source Mac from this USB SSD drive by connecting the USB device and restarting the Mac and immediately hold down the Option (or Alt) key. Then choose the USB drive from the boot options. Once booted, mount the LLIMAGER volume and run the program.


Hardware Based LLIMAGER version:


After obtaining the LLIMAGER USB SSD disk, insert into a Mac and you will need to remove the "LLIDATA" volume and use the space to create a partition for the macOS environment and a new LLIDATA volume. Create one small (~40GB: ex-FAT recommended) for the bootable macOS environment, and large one (remaining space: exFAT recommended) for storage, and name it , "LLIDATA". See "Create a bootable macOS environment partition to boot from a USB " below for instructions on creating the bootable macOS environment.


After the disk volumes are in place, you can boot the source Mac from this USB SSD drive by connecting the USB device and restarting the Mac and immediately hold down the Option (or Alt) key. Then choose the USB drive from the boot options. Once booted, mount the LLIMAGER volume and run the program.


Create a bootable MacOS environment partition to boot from a USB


Prerequisites

• USB Drive: A large USB SSD drive (2TB or larger recommended) with high read/write speeds.
  MacOS Installer: Download the macOS installer from the App Store. It should be compatible with the Mac you're using and the one you intend to boot from the USB.

Steps to Install macOS on a USB SSD Drive

1. Format the USB Drive:
   • Connect the USB drive to your Mac.
     Open Disk Utility (located in Applications -> Utilities).
     Select the USB drive in the sidebar.
     Click Erase, and format the drive as Mac OS Extended (Journaled) with GUID Partition Map. Note: For macOS Mojave and later, you may use APFS instead.
     Name the drive (e.g., "MacUSB") and click Erase.
2. Install macOS on the USB Drive:
   • Open the macOS installer you downloaded from the App Store.
     Proceed until you reach the screen where you select the disk you want to install macOS on.
     Choose Show All Disks and select your USB drive (“MacUSB” or whatever you named it).
     Follow the on-screen instructions to begin the installation on the USB partition (the 40GB partition that was created for the macOS)
3. Complete the Installation Process:
   • The installation process will take some time. The Mac may restart several times during the process.
     Once the installation is complete, the Mac will boot into the setup assistant.
4. Set Up Your macOS Environment:
   • You can set up your new macOS environment as you would on a regular Mac. This includes setting up an account, preferences, and installing any applications you need.

Important Notes

Compatibility: Make sure the macOS version is compatible with the Mac hardware you intend to use it on.

Power Supply: It’s advisable to keep the Mac plugged into a power source during the installation process.

Software Updates: After installation, you may need to run software updates to get the latest macOS version and patches.

This approach creates a fully functional macOS environment on a USB drive, useful for troubleshooting, testing, or portable use cases.

LLIMAGER supports logical disk acquisition of an APFS (Apple File System) file systems, and allocated space acquisitions of HFS+ (Mac OS Extended) file systems. For non-macOS-native file systems, use targeted disk mode.  

NOTE:

1. LLIMAGER with APFS:
   • Synthesized Volumes: LLIMAGER captures the entire APFS synthesized volume, which includes all the partitions or volumes within an APFS container. This typically includes the main system volume, a preboot volume, a recovery volume, and a VM (virtual memory) volume.
   • Unallocated Space: LLIMAGER does not capture unallocated space within the APFS container. 
2. LLIMAGER with HFS+:
   • Traditional Volume Structure: HFS+ uses a more traditional volume structure where each partition is distinct and has fixed space allocation.
   • Capturing Unallocated Space: When LLIMAGER is used with HFS+, it generally captures the data within the allocated space of the HFS+ volume. Since HFS+ doesn’t handle space allocation and management in the same way as APFS, the focus is more on the data within the defined partition boundaries, rather than unallocated space.

LLIMAGER is capable of acquiring partitions on external USB hard drives or SSDs, provided they are formatted in file systems that are compatible with macOS. For non-supported file systems, try LLIMAGER in targeted mode. 

When selecting "/" as the source, it's important to understand that LLIMAGER creates a full copy, not a point-in-time capture like a true snapshot.

The source internal Mac disk LLIMAGER images (referenced as "/") includes the startup volume, and the operating system, applications, files, and configurations, rather than a snapshot.

Though macOS reports the source for "/" as a snapshot, it's a quirk in how the file system is presented. / refers to the root directory, which encompasses the entire startup volume in macOS.

Here's an analogy: Imagine your startup volume as a house. Cloning with ASR is like copying the entire house, furniture, and all. macOS reporting / as a snapshot is like saying you're copying the front door (the entry point), but in reality, the entire house is being copied.

Use macOS, and follow these instructions 

The "com.apple.DiskManagement.disenter error 49244" is indeed a frustratingly vague error that can manifest in various macOS disk operations, including ASR (used by LLIMAGER) for Full File System imaging. Here's a breakdown of what's generally understood about it:

General Nature of the Error:

• Disk Management Issues:
  • The error points to problems within macOS's Disk Management framework, specifically when the system attempts to "disenter" (essentially, mount or recognize) a disk or volume.
• Varied Causes:
  • Apple's acknowledgment that it "can be a number of things." It's not a single, pinpointed hardware fault. Instead, it can arise from:
    • File system corruption.
    • Hardware issues (drive errors, faulty cables, etc.).
    • Compatibility problems between drives and macOS.
    • Improper disk ejection.
    • Software conflicts.

Specific Issues with LLIMAGER FFS Imaging and Sparse Bundles:

• ASR Vulnerability:
  • Again, LLIMAGER is using Apple Software Restore (ASR), but it's sensitive to underlying disk issues. When creating sparse bundles (which are used in backups), ASR can encounter problems if it hits a corrupted sector or encounters file system inconsistencies.   
• Sparse Bundle Complexity:
  • Sparse bundles are complex file structures. If there's any corruption within the bundle's metadata or data blocks, ASR can fail.   
• Lack of Specific Reporting:
  • Apple's error messages in these situations are often too general, making it difficult to pinpoint the exact cause.

Common Contributing Factors:

• External Drive Issues:
  • Many users report this error when working with external drives. Factors like:
    • Poor cable connections.
    • Power supply problems.
    • Drive formatting incompatibilities.
    • Underpowered USB hubs.
• APFS Complexity:
  • The Apple File System (APFS), while robust, can sometimes experience corruption, especially if there are unexpected system shutdowns or drive disconnections.   

Troubleshooting Strategies:

• Restart the Mac
• Verify no antivirus is active and all apps are closed.
• Disk Utility First Aid:
  • Always run Disk Utility's First Aid on both the source and destination drives.
• Check Hardware:
  • Test cables, try different ports, and ensure external drives have adequate power.
• Test Drives:
  • Use third-party disk diagnostic tools to check for hardware errors.
• Reformat Drives:
  • As a last resort, reformatting the destination drive can eliminate file system corruption.

• Run LLIMAGER in Safe Mode
• If able, update to most recent version of the hardware supported macOS
• As a last resort, perform a Targeted collection
• Release 5.1 will incorporate Time Machine based imaging which will be the next best thing to the FFS.

This error generally indicates a reboot is needed. 

When using a single destination device, the USB disk should have free space equal to or greater than twice the size of the source device’s used space plus 10%. If a separate Temporary Image (sparse) USB disk is used, each should have free space equal to at least the size of the used space plus 10%. Use these guides as a rule:

Version 4.x, and 5.x are backward compatible to macOS 11 (Big Sur) with an APFS file system.

Version 3.x is backward compatible to macOS 10.14 (Mojave) with an APFS file system.

NOTE: Your purchased license key file can be used on both versions. The trial key file is limited to the most current version.

Yes, starting with version 4.2.01, LLIMAGER optionally collects sysdiagnose in the default format.

The purchased license key file can be used on both versions. The trial key file is limited to the current version.