umjammer/[APFS] Forensic Mac APFS Fusion Drive.md

## [APFS] Forensic Mac APFS Fusion Drive.md

      
    Raw
  

              [APFS] Forensic Mac APFS Fusion Drive.md
            
          
    Rescue or Forensic Mac APFS Fusion Drive

USE AUTOPSY !!!
NO OTHER CHOICE
IT'S FREE AND OPEN SOURCE
install

brew's sleuthkit cannot use for build
$ cd /usr/local/src
$ brew install ant automake libtool afflib libewf postgresql testdisk doxygen
:
$ git clone --depth 1 https://github.com/sleuthkit/sleuthkit.git
:
$ cd sleuthkit
$ ./bootstrap
:
$ ./configure
:
$ make
:
$ cd ..
$ git clone --depth 1 https://github.com/sleuthkit/autopsy.git
:
$ cd autopsy
$ TSK_HOME=/usr/local/src/sleuthkit ant clean build build-zip
:
$ cd ..
$ unzip -x autopsy/dist/autopsy.zip