Skip to content

Known issues and Workarounds

Yogesh Khatri (@swiftforensics) edited this page Sep 19, 2020 · 24 revisions

MOUNTED (Live) mode

If using the MOUNTED option, you will need to run mac_apt with sudo in order for it to access system files and protected folders.
sudo python mac_apt.py -o ~/Desktop/mac_apt_output -x MOUNTED / FAST

MOUNTED (Live) volumes on Mojave (10.14) and above

If you are using the MOUNTED option to process the local disk on macOS Mojave (10.14.x), then in addition to running as sudo, you also have to provide Terminal full access to your disk by going to

System Preferences -> Security & Privacy -> Privacy -> Full Disk Access

and adding Terminal to the list of applications allowed. You can read more about it here.

Other Errors

VMDK related

MAIN-ERROR-Failed to load image. Error Details are: Unable to locate all extent data files.
This may happen if you renamed your vmdk file. If you did, revert to original name and try again. If that does not resolve the issue, there might be a problem with your vmdk file.

E01 errors

If you are getting a lot of plist read errors and the input file is an E01 type, it is possible that the underlying libewf library is not working properly to read the E01 format. Try using a different version of libewf in linux or macOS or linux subsystem (in windows). Refer to the installation document.

VC++ Redistributable dependency

Some of the code has a VC++ dll dependency, so you may need to download and install Microsoft Visual C++ 2015 Redistributable package.

Plugin Errors

Plugin related issues are listed here.

Getting Started

Plugins

Development

  • Write a Plugin
  • Plugin Helpers
Clone this wiki locally