Boot into tails via and copy files
Discussion
How could you prevent usb logging though? I plugged in nothing but a charge cable and immediately unplugged it and there were like 100+ IOPort logs and kernel logs.
Booting to another OS would happen at the firmware/BIOS level, I don’t think it would create a macOS level event in the logs
Aren't newer macbooks hard drives natively encrypted so that the files would be encrypted on download? I also don't think TAILS can boot on Apple Silicon (yet)
the data are encrypted
Recovery is a better way, you can even reset passwords, it’s integrated, no logs
Tails still does not support M-series chips. MacOS recommends to encrypt all data on the first setup.