Configuring Enterprise to collect from the macOS managed Agent

Created by: Brendan Bone
Created date:
Last Updated date:


This article discusses how to configure Enterprise 7.3 or later to collect from the macOS Managed Agent.



  • A working Forensic Tools environment with Enterprise, Quin-C, and QView installed on the same machine
  • Enterprise and Quin-C configured to use internal authentication, not Active Directory authentication
  • An installed macOS Managed Agent
  • The target added as a Mac to the Agent List in Enterprise
  • Ability for the Examiner machine to see the macOS target over the desired port
  • A network share that both the Examiner machine and macOS target can see



  1. In your desired case, go to Evidence > Add Remote Mac Data...
  2. At the Mac Agent Collection dialog, select the desired target and click Connect to Agent
  3. Click the gear icon in the upper-right corner
  4. At the Disk Image Path dialog, specify a network share that both the Examiner machine and macOS target can see, and an account with full access to that share, and click OK
  5. Proceed to select the folders, files, or volume you wish to collect/image
  6. Click the Review button to verify what you wish to collect, and start the collection
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


Powered by Zendesk