Roham! Mac OS

The maximum version of Mac OS X, OS X, or macOS supported by each G3 and later Mac follows. For complete specs on a particular system, click the name of the Mac. For all Macs that are compatible with a specifc maximum supported version of Mac OS X - courtesy of EveryMac.com's Ultimate Mac Sort - click the OS of interest. Navigate to the 'Format' tab, make sure Mac OS Extended (Journaled) is selected, click Apply and then click Partition. Making USB Bootable Installer with UniBeast app. Run the UniBeast 1.5.1 from /Applications folder. Skip through the first few screens before selecting the relevant USB drive on the Select a Destination screen.

Is your Mac up to date with the latest version of the Mac operating system? Is it using the version required by a product that you want to use with your Mac? Which versions are earlier (older) or later (newer, more recent)? To find out, learn which version is installed now.

If your macOS isn't up to date, you may be able to update to a later version.

Which macOS version is installed?

From the Apple menu  in the corner of your screen, choose About This Mac. You should see the macOS name, such as macOS Big Sur, followed by its version number. If you need to know the build number as well, click the version number to see it.

Which macOS version is the latest?

These are all Mac operating systems, starting with the most recent. When a major new macOS is released, it gets a new name, such as macOS Big Sur. As updates that change the macOS version number become available, this article is updated to show the latest version of that macOS.

If your Mac is using an earlier version of any Mac operating system, you should install the latest Apple software updates, which can include important security updates and updates for the apps that are installed by macOS, such as Safari, Books, Messages, Mail, Music, Calendar, and Photos.

Mac Os Mojave

By Kevin J. Ripa
PI, GSEC, GCFE, GCFA, EnCE, BAI, CDRP, CEH
Feb 15, 2016

This tutorial is based off of research done by Sam Bowne and a tool written by Johannes Stuettgen. The instructions have been updated by me to reflect the latest OSXs and to correct some code/syntax.

The instructions below are designed to extract a RAM dump from a running Mac Computer. This has NOT been tested on every Apple OS, but I have tested it on Mountain Lion, Mavericks, Yosemite, and El Capitan. It should work on any Intel based Mac. Instructions and screen shots are from El Capitan. Your system may vary slightly. Read all instructions FIRST, before attempting. This tutorial is about as simple and 'step-by-step' as it gets. If, after reading this, there are still things you don't understand, STOP before you START. If this is your first time dealing with acquisition of Apple computers, now is not the time to practice on a real case.

WARNING
It goes without saying that if you are doing a RAM dump, the computer is ON and LIVE. As such, you need to be extra careful about your processes and steps. The number one rule to live by is RECORD RECORD RECORD. Everything you do on the live machine needs to be recorded either via video/pictures, or in writing. Better yet, both. You WILL be changing system settings, and you WILL be potentially overwriting data. This is quite alright, as long as you have a GOOD reason, and can explain why.

SETUP
There are some necessary steps to perform prior to actually collecting the RAM.

1. It is assumed that you have already done a proper evidentiary collection of the device.
2. Prepare an external drive to save the data to. If you are only collecting RAM, anything larger than the RAM dump will be big enough. If you will also be collecting a live acquisition of the Mac computer, you will need an external drive large enough to hold that too. You can view a tutorial for live acquisition of Mac computer HERE. The external drive needs to be formatted for use on a Mac. You can view a tutorial on formatting Mac drives and partitions at HERE.
3. On a separate computer, download the open source program OSXPmem from http://bit.ly/20zyCFo or http://bit.ly/1mDxymI
4. Copy that program to your external destination drive that you will be saving the data to.
5. Now we turn our attention to the subject computer.
6. Ensure it is connected to a power cord. Do not do this on battery!
7. Go to Apple > System Preferences > Energy Saver
8. Make sure Computer Sleep and Display Sleep are both set to NEVER as shown below.

Roham Mac Os X

1. Next go to Apple > Security & Privacy
2. Click on the lock at the bottom left corner and enter the password if prompted, as shown below. If you do not have the password, you cannot make these changes. All this means is that you will have to work around the security prompt if you get it.

1. Make sure that 'Allow apps downloaded from:' is set to 'Anywhere', as shown below.

1. Close all windows that you have opened.

RAM ACQUISITION

1. Connect the destination external drive to the subject machine.
2. Access it, and move the program OSXPMem-RC1.tar.gz to the desktop of the subject machine. All of the rest of the steps are assumed to be on the subject machine.
3. Open a Terminal window. When typing the instructions below, only type what is inside the quotes. Don't type the quotes themselves. It is assumed that you will hit Enter at the end of each instruction. It will not always look like you accomplished anything. Don't worry about it. Keep following the steps unless you get some kind of error message. Anything placed inside < > is a variable that will be determined by you. Don't type the < >.
4. Type 'pwd'
5. Note the Username, as you will need it later. In the example below, it is 'JF'.

1. Type 'sudo su –'
2. You will be prompted for the subject computer user password. Enter it. If you don't have it, you are done unless you can find it.
3. Type 'cd /Users//Desktop'
4. Type 'tar xzf OSXPmem-RC1.tar.gz'
5. Type 'cd OSXPMem'
6. Type 'Date', and immediately take a photo of the output. Do not waste any time from this point forward.
7. Type './osxpmem /Volumes//.dump'. You can double check your typing below.

1. If you get an error message regarding a Kernel Extension from an unidentified developer, just click OK.
2. If all went well, you will now start to see data being populated in your terminal window, as seen below.

1. Once complete, you will see something like 'Successfully wrote elf image of memory', and you will be back at your command prompt, as seen below.

1. Again, type 'Date', and immediately take a photo. The reason you have done this is to show that you have not had time to alter data in the dump.
2. Immediately hash the RAM dump by typing md5 /Volumes//.dump'.
3. Once done, the hash of the file will be shown as below.

1. If you would rather hash using other processes like SHA, refer to the document outlining the different commands located HERE.
2. You are now done. Close the terminal window, and navigate to your destination drive. Right click on the .dd file you just created, and select 'Get Info'. In the screen that appears, click in the box beside the word 'Locked', as seen below. This will lock the file and protect from inadvertent writing later.

If all you were doing was collecting RAM, you are done. Close the terminal window, eject your destination drive from the desktop BEFORE you unplug it, and unplug.

If you are also gathering a live acquisition of the computer, proceed to the steps in the tutorial for Live Acquisition of Mac Computers, which can be found HERE.

As a point of reference, the RAM collection performed above, was on a MacBook Pro with Retina Display (mid 2012) with a 2.6 GHz Intel Core i7. It had 8 GB of DDR3 RAM, and was running El Capitan version 10.11.3. A beautiful ride to carlisle mac os.

Marcos speaks mac os. It was imaged to a SanDisk Extreme 64 GB thumb drive, and it took approximately 6 minutes.