Quick answer: APFS acquisition depends on Mac hardware, macOS version, encryption, and whether you need a physical or logical image. Preserve evidence with a validated acquisition method, documented handling, and cryptographic verification.
Watch the original video
Acquisition context and limitations
The original demonstration describes a historical macOS workflow. Pausing Disk Arbitration is not a validated substitute for write protection, and the displayed disk-number assumptions are not reliable across systems. Do not select an acquisition source by assuming that the second new disk is always the correct device.
Apple documents Intel Target Disk Mode and Apple silicon recovery-based transfer differently. Encryption, storage architecture, and tool support affect what can be acquired. A logical file transfer is not equivalent to a complete physical image.
Before acquisition, establish the evidence objective, identify the source and destination, and validate the method on the relevant hardware and operating-system version. Record handling and tool details, preserve originals, and use appropriate integrity verification. A matching hash alone does not demonstrate that every earlier handling step preserved the source.
Practical next steps
- Identify the Mac model, encryption state, required evidence, and acquisition scope.
- Use validated tools and write protection where supported; avoid treating a paused system service as proof of write protection.
- Record tool versions and device identifiers, preserve originals, and verify the acquired data with a modern hash such as SHA-256.
Frequently asked questions
Is Apple silicon Share Disk the same as Intel Target Disk Mode?
No. Apple documents different transfer workflows. Do not assume they expose the same devices or support identical forensic acquisition methods.
Does pausing Disk Arbitration guarantee forensic soundness?
No. A process workaround alone does not prove that evidence was unchanged. Validate the acquisition method and document its limitations.
Further reading: Official guidance and reference
