Webinars  |  On Demand

Best practices for Collecting from macOS 12 including the M1 chip

Ask the Expert - UFED Physical Analyzer

Aired: 16 December, 2021
Duration: 40 minutes

Valuable, insightful data stored on Windows and macOS computers is key to revealing the full picture during investigations in your organization. As the data stored on computers rises, so does the cost and scope of investigations. Ensuring Investigators are up to date on the latest operating systems and understanding the newest hardware is paramount to staying ahead of computer-based investigations.

Join us to learn about how investigators can harness Cellebrite Enterprise Solution’s new capabilities to tackle the challenges brought on by the latest changes for macOS.  Our latest capabilities allow investigators to perform physical imaging of modern macOS systems, Apple’s latest M1 hardware, and new macOS 12 Monterey release and how they impact corporate investigations.

Join Monica Harris, Enterprise Solutions Product Manager, and Dr. Joe Sylve, Head of Computer Forensic Research, as they discuss the following topics:

  • Capabilities added to support your corporate investigations:
    • Full support for all Intel and M1 macs, including the latest hardware released by Apple in November 2021
    • Support for Apple’s latest operating system macOS 12 Monterey
    • “Live” decrypted physical images of APFS containers and how to create a forensically sound image of a running system, without rebooting
  • Changes to your acquisition workflow to make the most out of your investigations
  • Caveats and Workaround for some relevant Apple changes in M1 hardware and software


  • Monica Harris Product Manager with Cellebrite Enterprise Solutions
  • Dr. Joe T. Sylve Head of Computer Forensic Research with Cellebrite Labs

Enterprise Solutions