Attach and mount a macOS system drive raw image

gistfile1.txt

===
Create a raw image
===

# Find the drive identifier
diskutil list

# Unmount the cached drive representation
diskutil unmountDisk <disk>

# Use the raw drive representation for higher speed. The cached one is extremely slow with dd.
# See for details: https://superuser.com/questions/631592/why-is-dev-rdisk-about-20-times-faster-than-dev-disk-in-mac-os-x
sudo dd if=/dev/rdisk<n> of=<path to image file> bs=32m

===
Mount the raw image
===

# Attach the raw dd image as a device
hdiutil attach -imagekey diskimage-class=CRawDiskImage <path to image file>

# Or use -nomount to create the device but not mount the volumes
hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount <path to image file>

When mounting a macOS drive image with FileVault encryption, the Data volume will not be automatically mounted.

To mount an encrypted volume:

# Find out the volume UUID
diskutil apfs list

# Unlock and mount
diskutil apfs unlockVolume <volume UUID>

===
Clean up
===

Unmount a volume:
hdiutil detach <volume>

Detach the drive:
hdiutil detach <disk>