I have recently had to solve the issue of AFF4 images too. I did try Arsenal Image Mounter to mount the image but found that when I tried to do anything such as export I was getting a BSoD and my workstation was shutting down. I use a product called UFS Explorer Professional Recovery which claimed to support APFS. The good news was that it did what it said on the tin, unlike some other products that claim to support APFS but don’t. We had two AFF4 images both of which had been from MacBook Pros with T2 chip - one had the password applied before imaging and the other didn’t. After trialling the AIM with it I gave up and used the Evimetry Bridge which mounted it as a Raw image. This worked well - UFS Explorer also allowed me to input the encryption key to the image that had not been unlocked and I was able to review the filesystem. I was then able to export the User areas to be able to review them in any other Forensic tools.
1 Like