THE DFIR BLOG
Menu

MacOS Forensics

How to mount an APFS Image?

7/20/2019

 
Step -1
sudo mkdir /Volumes/apfs_disk_image/
Step -2
sudo mkdir /Volumes/apfs_disk_mount/
Step -3
sudo xmount --in ewf --out dmg /Users/<Username>/APFS/apfs_disk.E01 /Volumes/apfs_disk_image/  
Step-4
hdiutil attach -nomount /Volumen/apfs_disk_image/apfs_disk.dmg
Step-5 
diskutil ap list
Step -6 (Optional)In case of encryption use this: 
diskutil ap unlockVolume <Disk Guid> -nomount
Step-7
sudo mount_apfs  -o rdonly,noexec,noowners /dev/disk#/Volumes/apfs_disk_mount/

Comments are closed.

    Archives

    May 2024
    July 2019
    April 2018

    Categories

    All
    Mac Forensics
    Plist

    RSS Feed

  • Infosec
  • Mac Forensics
  • Windows Forensics
  • Linux Forensics
  • Memory Forensics
  • Incident Response
  • Blog
  • About Me
  • Infosec
  • Mac Forensics
  • Windows Forensics
  • Linux Forensics
  • Memory Forensics
  • Incident Response
  • Blog
  • About Me