HOTLINE: 86 10-51315906

Thunder Mac OS Forensic Examination Workstation


This device relies on Apple's MacBook Pro platform, deploys guest boot loading solutions through Thunderbolt, USB, CD / DVD and other interfaces, and quickly performs different application operations such as hard disk mirroring, directional replication, and online forensics on the MAC system on site to meet different types and MAC forensics requirements in the state.

Hardware Configuration

* MacBook Pro Apple notebook, support Thunderbolt, USB 3.0 interface;

* Mac OS X operating system                                           

* MagSafe 2 power adapter port                                          

* 1 * Thunderbolt port (up to 10 Gbps)                                            

* 2 * USB 3.0 ports (up to 5 Gbps)                                       

* 1 * SDXC card slot                                            

* Configure MAC mirrorless tool                                            

* Pre-installed CFlab forensics comprehensive analysis system


* PC and Intel-based Mac computers (supporting most Intel-based Mac computers, including MacBook Air) can be booted in a way that complies with forensic specifications.

* Can make image files in many formats, including Expert Witness (.E01), EWF2 (.Ex01), Apple Disk Image (.dmg), RAW (.dd), SMART and AFF.

* Can be directly created as a virtual machine image file, such as .vmdk.                                            

* Can produce two evidence images or disk clones at the same time, and support the production of evidence files of different formats at the same time.

* Supports NTFS ,, HFS +, FAT32, EXT4 and ExFAT disks.                                            

* You can choose to make mirror files only for unallocated space, free space or file Slack area.                                            

* Quick erase, checksum, and hash of storage media.                                            

* Search and preview storage media by file name, keyword, or MIME type.                                            

* You can use Inception to recover your password from memory.                                            

* Use iPhone Analyzer to analyze iOS backup files.                                            

* Write-protect the suspect hard drive.                                            

* Get a complete image of the hard disk or selected partition (DMG format).                                            

* Automatically obtain user files and historical records as needed.                                            

* Complete search of evidence information of Mac0SX 10.7 or above (supporting the latest Mac OSX 10.11) X through preset case configuration information.

* Report formats support PDF, HTML, CSV, and XML.                                            

* Powerful timeline analysis.                                            

* Track and query suspect location information.                                            

* Find and recover user and system passwords.                                            

* Analyze and identify the source of some files.                                            

* Various search and filtering methods to quickly find evidence files.                                            

* Custom create and save case templates.                                            

* DMG and E01 and Ex01 evidence files can be loaded.                                            

* Identify and export virtual machines.

京ICP备19057614号-1    北京天宇宁达 Copyright © 2019 CFLAB.All Right Reserved.