I thought MQ was going to be the absolute bees-knees when it came to imaging Apple computers, with the promise of Physical Images (with unallocated space) and APFS Queue files being the headline must have features.  I was excited!

Its all a bit Plug and Pray:

What I found in testing is that MQ has been almost completely crippled by the recent updates to Apple's hardware and operating systems and to my eyes, has been left to fade into a shadow of its former self due to lack of updates.

BB market this product to prospective customers (not all of which have zen like knowledge of the Apple product lineup) - the marketing hook stating "Image over 185 Apple machines" sounds mighty impressive to your average investigator.  Being as polite as possible, they are simply not telling you the real world capabilities of the product on contemporary machines.

When you also consider the "logical data/artefact collection" featuredid not perform well for non-apple applications, (such as Microsoft Office 365) it paints a very dim picture of something that once was - in my opinion the pinnacle of Mac imaging.  Perhaps this was down to lack of compatibility with my Mojave operating system on the the test machine - but all I can say is it did not perform well for me.

Can't Boot - Won't Boot:

When you note that most T2 machines from 2019 onwards simply won't boot from the MQ dongle anymore, and anything running Catalina 10.15 or later won't let you do a full loose file collection from the booted suspect machine or a live disk image of the machine, thats three major features that don't work as intended anymore.

These late model machines are what I am seeing now in my investigations, most corporates ditch anything older than 3 years (for tax write-downs and reliability reasons) so the days of seeing anything pre 2018 (which you can boot from with the current MQ dongle) are rapidly diminishing.

The only way forward now to image contemporary machines is to purchase another Apple laptop that you can take out into the field so that you can connect them together via a cable and do Target Disk Mode acquisitions.

Don't forget your Softblock if you need write protection of that TDM suspect machine!

Walking on Eggshells:

We then have the stability issues that I observed in such simple things as dialogue boxes, sure some of this may be Apple's code, but some isn't - I've never seen anything like this before in a released to market "forensic" product.

Hopefully someone senior within Cellbrite will read this review and use this information for the reason it has been put here - to improve the purchasing/usage experience for everybody - and make some changes to the marketing material. 

It is not a bad product, it just has some silly periphery issues.

Be Up Front:

Just being a little more upfront about the latest Apple imposed limitations would be a good start - I know it is not your fault BB - these are Apples restrictions - not yours.  A simple table in the back of the manual detailing what is and what is not going to work on any given machine is all that is required to remedy this.

The Elephant in the Room:

So this leads us back to the elephant in the room, these "Physical Images".

You have to think to yourself, how many cases you worked that involved evidence in unallocated space, or the APFS file queue.  If your answer is "lots" or you are in law enforcement where you absolutely must examine those areas on every case, then you need MQ.

However on the flip side of the coin, if you never carve unallocated space and your workflow only requires you to pull live or deleted recoverable files from within the custodian computers' file system (documents/Emails etc), then you will be paying for features that you will never use.

Ultimately the decision of what you buy is up to you, do your homework and have a free trial is the way to go, look up Tom Oldroyd at BB Sales and have a chat with him.

Would I Buy It ?

Well after spending a *long time* testing this product, I can say hand on heart, that this one is not for me.  If they improved the Data Collection detection of non Apple programs then yes I would be more interested, but then the cost would, at least for me, be prohibitive.

The door is open for Cellbrite to submit the next version of MQ to CFRO for long-term review.

Who knows, they may pull out of the bag Super Vendor status and a CFRO Sizzler award next time, nobody knows !!!!

If I hear anything from BB about the new version, I'll update this review and let all you subscribers know via the newsletter!

Thanks!

I've really enjoyed writing this review, although MQ has some issues they need to sort out, I enjoyed working with it and recording my findings.

Its fair to say that I will never be caught out by an Apple machine in the near future - well until Apple make more workflow breaking changes!

Thank you for all of your support and kind messages - I enjoy reading them and reply to every one of them when time allows.

Scoring & Awards:

Don't forget to sign up for our newsletter which will keep you up to date on new reviews (and updates to existing ones) as they are posted !

Please share this article on your social networks!

CFRO does not accept gifts, severed fingers, death threats, cash or any other form of reward for publishing a review on its website, always and forever independant warts and all reviews.  Subscribe to be notified of new content.

Competition entries must be received no later than December 2019.