-
Notifications
You must be signed in to change notification settings - Fork 103
Known issues and Workarounds
If using the MOUNTED option, you will need to run mac_apt with sudo
in order for it to access system files and protected folders.
sudo python mac_apt.py -o ~/Desktop/mac_apt_output -x MOUNTED / FAST
If you are using the MOUNTED option to process the local disk on macOS Mojave (10.14.x), then in addition to running as sudo
, you also have to provide Terminal full access to your disk by going to
System Preferences -> Security & Privacy -> Privacy -> Full Disk Access
and adding Terminal to the list of applications allowed. You can read more about it here.
MAIN-ERROR-Failed to load image. Error Details are: Unable to locate all extent data files.
This may happen if you renamed your vmdk file. If you did, revert to original name and try again. If that does not resolve the issue, there might be a problem with your vmdk file.
If you are getting a lot of plist read errors and the input file is an E01 type, it is possible that the underlying libewf library is not working properly to read the E01 format. Try using a different version of libewf in linux or macOS or linux subsystem (in windows). Refer to the installation document.
Some of the code has a VC++ dll dependency, so you may need to download and install Microsoft Visual C++ 2015 Redistributable package.
Plugin related issues are listed here.
Getting Started
- Introduction
- Installation
-
Sample Usage
- ios_apt
- Artifact Only Mode
- Mounted System Data Mode
- Interpreting Output
- Issues & Workarounds
Plugins
- AUTOSTART
- BASICINFO
- BLUETOOTH
- DOMAINS
- FSEVENTS
- IDEVICEBACKUPS
- IDEVICEINFO
- IMESSAGE
- INETACCOUNTS
- INSTALLHISTORY
- MSOFFICE
- NETUSAGE
- NETWORKING
- NOTES
- NOTIFICATIONS
- PRINTJOBS
- QUARANTINE
- RECENTITEMS
- SAFARI
- SCREENTIME
- SPOTLIGHT
- SPOTLIGHTSHORTCUTS
- TERMINALSTATE
- TERMSESSIONS
- UNIFIEDLOGS
- USERS
- WIFI
Development
- Write a Plugin
- Plugin Helpers