±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 12
Overall: 26992
Visitors: 235

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Macbook Air Acquisition

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3 
  

Re: Macbook Air Acquisition

Post Posted: Sun Aug 07, 2011 7:04 am

USB hub...  

PM_SQ
Senior Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Mon Aug 08, 2011 2:12 pm

Ah ok Smile
So obvious
Thx  

Ricco
Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Fri Aug 19, 2011 2:29 pm

How are you booting this FTK Gui on macbook air? Some sort of boot CD? A specific booting method like target mode, etc.

Any details please.

Thank you.

- isth
Hi All,

I just acquired one of these and wanted to share my findings. This was a newer Macbook Air with 2 USB ports:

-Raptor allows you to boot into the machine but does not recognize the SSD drive.
-Paladin allows you to boot into the machine but does not recognize the SSD drive. This one shouldn't have been a surprise but the website clearly states "Boot standard PCs and Intel Macs in a forensically sound manner (including the MacBook Air)" so I was hoping that one would intend to image the mac after booting into it forensically.
-LinEn allows you to boot into the machine but does not recognize the SSD drive.

I ended up using FTK Imager for Mac GUI (http://www.appleexaminer.com/Utils/Downloads.html) to perform a live acquisition. It took about 2 hours to capture/transfer the 128GB drive to a USB2.0 external drive.

I am also told that EncasePortable will do the job (using the boot CD, as it won't boot of USB drive).

Hope this helps some people in the future!
 

forensicakb
Senior Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Sun Sep 18, 2011 2:33 pm

You could remove the SSD Board and use a USB bridge to acquire the contents.

You can get a device suitable for the 2010/2011 MacBook Airs from Other World Computing

You will also need a pentalobe screwdriver to open the case, which you can get from eBay

Hope this helps  

JDCoulthard
Senior Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Mon Nov 12, 2012 10:15 am

- forensicakb
How are you booting this FTK Gui on macbook air? Some sort of boot CD? A specific booting method like target mode, etc.

Any details please.

Thank you.



Sorry for the incredibly delayed response. The FTK GUI was run from a USB drive (also used as destination) after logging into the machine with the user's credentials. The collection was for discovery purposes.

Thanks.  

isth
Senior Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Mon Nov 12, 2012 11:49 pm

has anyone tried to use thunderbolt in target disk mode? my understanding is that it should work the same way as firewire.  

randomaccess
Senior Member
 
 
  

Re: Macbook Air Acquisition

Post Posted: Wed Dec 05, 2012 4:52 pm

I do not have two Macs with Thunderbolt to test this it, but I can tell you that a thunderbolt-only MacBook with a Thunderbolt to Firewire adapter will work in Target Disk Mode when connected to a computer with a Firewire port.

If that helps.  

Bulldawg
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 3 of 3
Go to page Previous  1, 2, 3