Follow

Configuring Enterprise to collect from the macOS managed Agent

Created by: Brendan Bone
Created date:
Last Updated date:

Overview

This article discusses how to configure Enterprise 7.3 or later to collect from the macOS Managed Agent.

 

Prerequisites

  • A working Forensic Tools environment with Enterprise, Quin-C, and QView installed on the same machine
  • Enterprise and Quin-C configured to use internal authentication, not Active Directory authentication
  • An installed macOS Managed Agent
  • The target added as a Mac to the Agent List in Enterprise
  • Ability for the Examiner machine to see the macOS target over the desired port
  • A network share that both the Examiner machine and macOS target can see

 

Procedure

  1. In your desired case, go to Evidence > Add Remote Mac Data...
  2. At the Mac Agent Collection dialog, select the desired target and click Connect to Agent
    mceclip0.png
  3. Click the gear icon in the upper-right corner
    mceclip1.png
  4. At the Disk Image Path dialog, specify a network share that both the Examiner machine and macOS target can see, and an account with full access to that share, and click OK
    mceclip2.png
  5. Proceed to select the folders, files, or volume you wish to collect/image
  6. Click the Review button to verify what you wish to collect, and start the collection
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk