MacImager™ is a Mac OS X based drive imaging tool for securing evidence for further forensic analysis. Designed for the digital forensics and e-discovery professionals, the easy-to-use yet powerful tool allows investigators to secure evidence from drives or media in the form of disk images. MacImage is device and file system independent, and uses a proprietary fault tolerant acquisition to work around disk errors to obtain as much valid data as possible.
To support forensic needs of different forensic communities, MacImager supports MD5 hashing algorithm. Whether the drive or media is sound or faulty, MacImager is the only choice when it comes to forensics disk imaging.
MacImager disk imaging software uses a proprietary fault tolerant acquisition to work around disk errors to obtain as much valid data as possible. Whether the drive or media is sound or faulty, MacImager is the only choice when it comes to forensics disk imaging.
Complete device imaging: every sector of the device is copied. The software supports all file systems such as HFS, NTFS, FAT, FAT32, and Linux. MacImager works with USB key, PC disk, Linux disk, FAT32 disk, FLASH card, Digital Cameras, and almost any other media or file system that can be recognized in Mac OS X. Disk images created using the acquisition process with MacImager are saved in Apple’s standard DMG format and can be opened and read by many standard applications such as MacForensicsLab or Cache Detective for further analysis of the data.
Imaging a damaged hard disk or storage medium with bad blocks. When ordinary data acquisition tools encounter hard disk with bad blocks, most will try to read the bad block data repeatedly, and ultimately abandon the imaging process when the bad blocks cannot be read. More over, in the event of hard disk with multiple bad blocks, using hard disk read-write head and trying to read bad data repeatedly may cause the hard disk to heat up and damage. MacImager uses a special algorithm that can effectively address sectors with bad data, and recovers as much data as possible.
Written specifically for Mac OS X, MacImager includes powerful features that give a user excellent flexibility in imaging a volume or a device:
- Image drive in device level.
- Proprietary fault tolerant acquisition works around disk errors to create disk image.
- Independent of operating system.
- Support high-speed interface such as USB 3 and Thunderbolt.
- MD5 HASH support.
- Images acquired are saved in open ISO standard and can be read by many Mac applications.
- Extremely easy-to-use interface. No special training necessary.
- OS X 10.6 (Snow Leopard) or above
- Built for OS X Yosemite
- Intel based Macintosh
- Plenty of disk storage space