This is exactly what I was just demoing for you.
So as you are in Finder on a Mac,
it's prompting you to enter a passcode.
That checkbox is there by default. Be very careful.
You want to uncheck it.
Your screen should never look like it
does on the left forensically.
You want to enter a passcode that is consistent in your lab.
In my last lab, we always did 5555
because it's something we all knew.
Think about how frequently people leave the workplace.
What if someone else did the acquisition,
and you later need to examine it?
You want to make sure you have access to this data.
So use a password that is consistent with your lab.
Make sure you verify the passcode, and never ever check,
remember password in this keychain.
If you're on iTunes, this will not even be prompted of you.