====== Forensic on Mac ======

%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%%ICON{wip}%
  - Do not write anything on the disk and/or make clean disk image
    - disable automounter 
      * onetime <code>sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist</code>
      * persistent <code>sudo mv /System/Library/LauchDaemons/com.apple.diskarbitrationd.plist ~/Backup/</code>
  - dcfldd <code>/opt/local/bin/dcfldd if=/dev/disk2s2 hash=sha1 sha1log=/Volumes/Backup\ 500G/verification.txt bs=512 conv=noerror,sync split=10G of=/Volumes/Backup\ 500G/image.raw</code>