±Your Account
Membership:
New Today: 8
New Yesterday: 7
Overall: 24189
Visitors: 50±Latest Webinar
±Latest Articles
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Go to page Previous 1, 2, 3
Sorry for the incredibly delayed response. The FTK GUI was run from a USB drive (also used as destination) after logging into the machine with the user's credentials. The collection was for discovery purposes.
Thanks.
Macbook Air Acquisition
-
PM_SQ - Senior Member
-
Ricco - Member
Re: Macbook Air Acquisition
Posted: Fri Aug 19, 2011 2:29 pm
How are you booting this FTK Gui on macbook air? Some sort of boot CD? A specific booting method like target mode, etc.
Any details please.
Thank you.
Any details please.
Thank you.
- isthHi All,
I just acquired one of these and wanted to share my findings. This was a newer Macbook Air with 2 USB ports:
-Raptor allows you to boot into the machine but does not recognize the SSD drive.
-Paladin allows you to boot into the machine but does not recognize the SSD drive. This one shouldn't have been a surprise but the website clearly states "Boot standard PCs and Intel Macs in a forensically sound manner (including the MacBook Air)" so I was hoping that one would intend to image the mac after booting into it forensically.
-LinEn allows you to boot into the machine but does not recognize the SSD drive.
I ended up using FTK Imager for Mac GUI (http://www.appleexaminer.com/Utils/Downloads.html) to perform a live acquisition. It took about 2 hours to capture/transfer the 128GB drive to a USB2.0 external drive.
I am also told that EncasePortable will do the job (using the boot CD, as it won't boot of USB drive).
Hope this helps some people in the future!
-
forensicakb - Senior Member
Re: Macbook Air Acquisition
Posted: Sun Sep 18, 2011 2:33 pm
You could remove the SSD Board and use a USB bridge to acquire the contents.
You can get a device suitable for the 2010/2011 MacBook Airs from Other World Computing
You will also need a pentalobe screwdriver to open the case, which you can get from eBay
Hope this helps
_________________
EviGator Digital Forensics
iPhorensic - Examine iPhone backups with ease.
You can get a device suitable for the 2010/2011 MacBook Airs from Other World Computing
You will also need a pentalobe screwdriver to open the case, which you can get from eBay
Hope this helps
_________________
EviGator Digital Forensics
iPhorensic - Examine iPhone backups with ease.
-
JDCoulthard - Senior Member
Re: Macbook Air Acquisition
Posted: Mon Nov 12, 2012 10:15 am
- forensicakbHow are you booting this FTK Gui on macbook air? Some sort of boot CD? A specific booting method like target mode, etc.
Any details please.
Thank you.
Sorry for the incredibly delayed response. The FTK GUI was run from a USB drive (also used as destination) after logging into the machine with the user's credentials. The collection was for discovery purposes.
Thanks.
-
isth - Senior Member
Re: Macbook Air Acquisition
Posted: Mon Nov 12, 2012 11:49 pm
has anyone tried to use thunderbolt in target disk mode? my understanding is that it should work the same way as firewire.
-
randomaccess - Senior Member
Re: Macbook Air Acquisition
Posted: Wed Dec 05, 2012 4:52 pm
I do not have two Macs with Thunderbolt to test this it, but I can tell you that a thunderbolt-only MacBook with a Thunderbolt to Firewire adapter will work in Target Disk Mode when connected to a computer with a Firewire port.
If that helps.
If that helps.
-
Bulldawg - Senior Member