Completing Mac forensic collections can be a challenge. Many digital forensics and legal IT professionals are concerned when they need to collect data from Mac systems for the following reasons.
- Finding an application that runs natively across current macOS operating systems
- Finding an application that can run from an external device without installation
- Macs with encrypted drives require a live acquisition
- Difficulty pulling a drive from a Mac for a forensic image
- Simplified functionality for end users with minimal technical expertise
- Includes a hash verification, a chain of custody audit log, and preserves file timestamps and metadata
Some have used Target Disk Mode or a bootable Linux drive. It has been found that the additional hardware, knowledge of creating a bootable drive, and expertise in running Linux applications are time-consuming or out of their reach. Even if IT professionals can get a drive image, if it is encrypted, the resulting copy, in most cases, is inaccessible.
Additionally, many corporate security IT users dislike installing new and unverified software on the firms’ employees’ systems. Due to increased data breaches and ransomware, IT security professionals must undergo extensive vetting processes for temporarily installed software. Instead, they would run software from an external device rather than install new applications on a custodian’s computer.
For these reasons, Pinpoint Labs, a leader in digital forensics and eDiscovery collection software, developed Pinpoint CrossCopy, a cross-platform defensible collection software. For more than 16 years, Pinpoint Labs has provided portable, enterprise-level, easy-to-use, and scalable tools.
Pinpoint CrossCopy runs natively on macOS systems, and users can leverage its speed and filtering options on Windows and Linux systems. Furthermore, CrossCopy will run from an external flash drive or hard drive, which does not require installation on the host computer. The software comes configured so that all files and logs are automatically copied back to the external devices and only requires users to drag and drop files or folders into a window and click Run.
Pinpoint CrossCopy addresses the challenges digital forensics, legal IT, and security professionals face regarding macOS eDiscovery and forensic collections. The bonus that the software is multi-threaded, fast, and has the corresponding Windows and Linux versions means clients can leverage their investment and save money by reducing training time and how many products they need to maintain. Whether users need to perform remote custodian interviews, meet GDPR requirements, or make FOIA requests, Pinpoint CrossCopy is a much-needed tool.
About Pinpoint Labs
Pinpoint Labs, the global enterprise software company, provides an industry-leading collection, processing, and review technology platform. Pinpoint offers on-premises and cloud-based solutions that get forensic and eDiscovery professionals on the fastest and most efficient path to discovery. Pinpoint lets developers focus on what they do best: build software that helps legal teams while giving peace of mind to management with robust controls, tools, and reports.
Pinpoint was founded over 16 years ago by computer forensic examiners Jon Rowe and James Beasley. Their experience includes over 30 years of litigation support and over two decades in software development.
Please visit www.pinpointlabs.com to schedule a product demonstration or to request an evaluation license.