New in MacQuisition 2013 R2:
- Improved FileVault 2 Detection - Automatically detect the presence of a FileVault 2-encrypted volume, and enter a known password or recovery key directly within MacQuisition to unlock it.
- Multi-Destination Forensic Image Acquisition - Drag and drop volumes and/or folders to the Image Device window to send acquired forensic images to multiple destinations simultaneously.
- Custom Preference Settings - Automatically compare and verify MD5, SHA1, and/or SHA256 hash values before and after imaging. Specify default alias handling and set a default timestamp (Unix epoch or Gregorian) reporting format.
- New Collection Options - Collect attached/mounted device connection artifacts and a list of installed applications.
- Advanced Status Tracking and Reporting - Verify before, during, and after file hashes, and created (birth) and modified timestamps. Review extensive collection tracking and error reports saved to a standard .csv file format.