MacOS And Apple Silicon Forensics

Frequently asked questions

Can you just image the Mac's hard drive like any other computer?

Not on Apple Silicon (§4). The storage is soldered to the board, so there is nothing to remove; it is hard w are- encrypted, so it is unreadable at rest without the machine and its keys; and secure boot blocks the old trick of imaging it from external media. The classic pull-and-image method simply does not work. The Mac is instead acquired live and logically, on the running, unlocked machine, which is where its data is readable (§5).

What is the single most important thing when seizing a Mac?

Keep it powered on and unlocked (§7, Example 1). A running, unlocked Apple Silicon Mac can be acquired; a switched-off, locked one may be an encrypted brick without the credentials. The reflex from old training, to power a machine down, is exactly wrong here. So the machine is kept awake and unlocked, prevented from locking or sleeping into a locked state, protected from remote wipe, and acquired as soon as possible while access lasts.

Is a live logical acquisition as good as a full image?

For a modern Mac it is the correct and defensible method, not a compromise (§5, Example 2). Because no physical image is obtainable, the live logical or targeted collection, taken from the unlocked machine, hashed, documented and validated, is the sound approach, and done properly it is as accountable and reproducible as a classic image. The rigour, integrity, documentation, validation, is unchanged; only the technique adapts to a machine whose data is readable only while it runs.

The Mac is locked and we do not have the password. Can you break in?

Honestly, usually not by direct attack on a powered-off Apple Silicon machine (§6, Example 3). The credible answer is not a promise to crack it but the lawful alternatives: obtain the password by cooperation or an order (guide 117), and reach the same data through the iCloud account and any backups, which often hold much of it (§8). A reputable expert states this limit plainly rather than overpromising, and pursues the routes that actually work.

If we cannot access the Mac, is the evidence lost?

Often not (§8, Examples 1 and 3). A Mac sits in a tightly integrated Apple estate: iCloud holds synced files, mail, messages and photos; the paired iPhone or iPad holds the same messages and libraries; and Time Machine or other backups hold prior states. Reached through the account or the other devices by consent or lawful process, these frequently hold much of the same evidence. The Mac being inaccessible is a setback, not usually the end of the enquiry.

Does this apply to older Intel Macs too?

Partly (§3). Older Intel Macs may have removable storage and different boot behaviour, so some classic techniques can still apply, though File Vault encryption and the T-series security chips on later Intel models bring similar constraints. Apple Silicon machines are the fullest expression of the new reality, soldered, hard w are- encrypted, secure-booted, but the direction of travel is the same, and every Mac is assessed on its specific model, chip and configuration. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17