+65 6747 4469

55 Ubi Avenue 1, UBI 55, #06-09, Singapore 408935

©2019 by DataExpert Singapore Pte Ltd.

Key Features

  • Target and forensically acquire files, folders, and user directories while avoiding known system files and other unneeded data
  • Preserve valuable metadata by maintaining its association with the original file
  • Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions
  • Thoroughly log data acquisitions and source device attributes throughout the collection process
  • Selectively acquire email, chat, address book, Calendar, and other data on a per-user, per-volume basis



  • Capture important live data such as Internet, chat, and multimedia files in real time
  • Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device
  • Choose from 26 unique system data collection options, including active system processes, current system state, and print queue status



  • MacQuisition automatically recognizes a combined volume from a Fusion Drive and presents it for imaging
  • If FileVault 2 exists, the examiner can, with use of the password, Keychain file or recovery key, mount the volume in a read-only fashion, allowing for either a triage or collection of the files
  • Use the source machine's own system to create a forensic image by booting from the MacQuisition USB dongle
  • Write-protect source devices while maintaining read-write access on destination devices
  • Extensively log live data acquisition information throughout the collection process


Key features of MacQuisition™ 2018 R1.2 include:

  • Formatting and imaging to NTFS drives
  • Unlocking APFS with FileVault 2 encryption
  • Capturing RAM and data collections live on High Sierra 10.13
  • Creating logical data containers for collections
  • Support for APFS formatted drives, with or without encryption, including logical file collection


  • MacQuisition is a powerful, 3-in-1 solution for live data acquisition, targeted data collection, and forensic imaging. Tested and used by experienced examiners for over a decade, MacQuisition runs on the Mac OS X operating system and safely boots and acquires data from over 185 different Macintosh computer models in their native environment - even Fusion Drives. There’s no need for complicated take-aparts when you’ve got MacQuisition.

    IMAC iMac (Late 2009)
    Model Identifier: iMac10,1 / 11,1
    iMac (2017)
    Model Identifiers: iMac18,1 / 18,2 / 18,3
    IMAC PRO iMac Pro (Late 2017)
    Model Identifier: iMacPro1,1†

    iMac Pro (Late 2017)
    Model Identifier: iMacPro1,1†

    MAC MINI Mac mini (Mid 2010)
    Model Identifier: Macmini4,1
    Mac mini (Late 2014)
    Model Identifiers: Macmini7,1
    MAC PRO Mac Pro (Mid 2010)
    Model Identifier: MacPro5,1
    Mac Pro (Late 2013)
    Model Identifier: MacPro6,1
    MACBOOK MacBook (Late 2009)
    Model Identifier: MacBook6,1
    MacBook (2017)
    Model Identifier: MacBook10,1
    MACBOOK AIR MacBook Air (Late 2010)
    Model Identifier: MacBookAir3,1 / 3,2 
    MacBook Air (2017)
    Model Identifiers: MacBookAir7,2
    MACBOOK PRO MacBook Pro (Mid 2010)
    Model Identifier: MacBookPro6,1 / 6,2 / 7,1 
    MacBook Pro (2017)
    Model Identifiers: MacBookPro14,1 / 14,2 / 14,3


    * Certain older 2007-2009 models that are not supported by the MacQuisition 2018R1 partition may be bootable by the MacQuisition Secondary partition. Having trouble identifying a Mac OS X system? We recommend the MacTracker App, available for free at the App Store.

    † T2 chip default encryption may be present.