Briefly describe acquisition methods in macOS.

What will be an ideal response?

ANSWER: To examine a computer running macOS, you need to make an image of the drive, using the same techniques described in Chapter 5. You should be aware of some exceptions, however, caused by Apple design and engineering. (In addition, removing the drive from a Mac Mini case is difficult, and attempting to do so without Apple factory training could damage the computer. A MacBook Air poses similar problems, as you need special Apple screwdrivers to open the case.) You need a macOS-compatible forensic boot CD/DVD to make an image, which then must be written to an external drive, such as a FireWire or USB drive. Larger macOS systems are constructed much like desktop PCs, making removal of the hard drive easier.