Talk With an Expert

Fuji - A New Open Source Tool for Full File System Acquisition of Mac Computers

Fuji - A New Open Source Tool for Full File System Acquisition of Mac Computers (PDF, 4.17MB)Last updated: 29 Sep, 2024
Presented by:
Andrea Lazzarotto
Andrea Lazzarotto
  • SANS DFIR Europe - Prague 2024

The advent of Apple Silicon introduced new challenges for forensic acquisition on macOS devices, as traditional imaging tools like dd or Disk Utility cannot be used due to hardware-level encryption. This issue inspired the creation of Fuji, a free and open-source tool designed for the forensic acquisition of Mac computers.

Fuji leverages native Apple utilities such as ASR and Rsync to perform a Full File System (FFS) live acquisition, thus working even on encrypted drives. It generates DMG files compatible with tools like FTK Imager and Autopsy.

We will explore what Fuji is capable of, the differences between its acquisition modes, and how it was developed using Python.

Fuji - A New Open Source Tool for Full File System Acquisition of Mac Computers | SANS Institute