Mac SSD adapters fo...
 
Notifications
Clear all

Mac SSD adapters for imaging

11 Posts
7 Users
0 Likes
1,622 Views
(@klunk)
Posts: 2
New Member
Topic starter
 

Hi all,

Been away for a while.

I have been tasked to image a macbook pro, not sure what year yet.

I know they changed SSD spec in late 2013, so i need to be able to go onsite with bother adapters to image the SSD.

Can anyone point me in the direction to have all eventualities covered?

I am searching but not really finding many answers.

Many thanks in advance!!

K

 
Posted : 19/04/2016 8:33 pm
(@deltron)
Posts: 125
Estimable Member
 

Hi all,

Been away for a while.

I have been tasked to image a macbook pro, not sure what year yet.

I know they changed SSD spec in late 2013, so i need to be able to go onsite with bother adapters to image the SSD.

Can anyone point me in the direction to have all eventualities covered?

I am searching but not really finding many answers.

Many thanks in advance!!

K

can you do target disk mode imaging or macquisition
https://www.blackbagtech.com/software-products/macquisition-6/macquisition.html

 
Posted : 19/04/2016 9:12 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

It's not something easily found.

The "old" Macbooks used "conventional" SATA interface.

The "new" ones seemingly use a PCIe connection, but not in the form of one of the zillion M.2 connector form factors
https://en.wikipedia.org/wiki/M.2#Form_factors_and_keying
as the good Apple guys like to invent their own standards, namely a 28 pin (yet another) *something*, see this
http//www.microsatacables.com/2013-macbook-28-pin-ssd-to-m2-ngff-pcie-4x-adapter-apl-m2-896

There are USB 3.0 enclosures for them, they are (being Mac dedicated) a lot more costly than they should be, examples
http//eshop.macsales.com/item/OWC/MAU3ENPRPCI/
http//pc-adapter.net/products/794.html
http//eshop.sintech.cn/20132014-macbook-a1465-1466-a1398-a1502-ssd-usb-30-external-ca-p-1080.html

Or (if you already have something M.2 compatible
http//eshop.sintech.cn/2013-2014-2015-macbook-pro-air-ssd-to-m2-ngff-pcie-adapter-p-1096.html

jaclaz

 
Posted : 19/04/2016 9:15 pm
(@tacobreath)
Posts: 14
Active Member
 

Assuming the Macbook has an SSD, you may be able to image the SSD using a Linux based program like Paladin (https://www.sumuri.com/). The newer version of Paladin (EDGE) will image the newer Macs with soldered SSDs (NVMExpress).

Essentially you connect a powered USB hub to the Mac, and then connect the Paladin USB drive and a target drive (external HDD with USB connection, etc.) to the powered USB hub. Then power on the Mac and boot to Paladin. If you like, you can connect a write-blocker in between the Mac and your target drive, but Paladin does have write protection built into it.

I am not affiliated with Paladin or Sumuri in any way, just a user.

Best of luck!

 
Posted : 20/04/2016 4:56 am
(@hommy0)
Posts: 98
Trusted Member
 

The MacBook Pro should support Target Disk mode, and is how I have imaged in the past.

Boot the Mac first with the option key to check for an EFI password, if this is not present reboot into Target Disk mode.

Image then with your tool of choice, connecting via a writeblocker to your forensic workstation.

Most likely you will need to adapt the thunderbolt connection to FireWire 800 (for which there is an adapter in the Apple Store), If you are using a Windows based tool.

 
Posted : 20/04/2016 12:58 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Boot the Mac first with the option key to check for an EFI password, if this is not present reboot into Target Disk mode.

And if it is present? ?

jaclaz

 
Posted : 20/04/2016 1:41 pm
(@klunk)
Posts: 2
New Member
Topic starter
 

Thank you for all the replies.

I am currently imaging mac to mac through a Tableau firewire write blocker and a thunderbolt to firewire 800 adapter on each mac.

The image is being written to an external USB3 hdd.

The imaging host I have booted to Kali 2 and I am using guymager with the subject device is target disk mode.

It is pretty quick actually.

I am in the process of ordering macquisition.

Is there any issue booting the subject machine to Kali in forensic mode ( I note paladin above) and just connecting a USB drive and imaging to that, thereby only using one machine and eliminating the tableau?

Thanks again

K

 
Posted : 20/04/2016 8:29 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Is there any issue booting the subject machine to Kali in forensic mode ( I note paladin above) and just connecting a USB drive and imaging to that, thereby only using one machine and eliminating the tableau?

Maybe 😯 .
JFYI (only seemingly off topic)
http//www.forensicfocus.com/Forums/viewtopic/t=14057/
Starting around here
http//www.forensicfocus.com/Forums/viewtopic/p=6582616/#6582616

jaclaz

 
Posted : 20/04/2016 9:20 pm
(@thefuf)
Posts: 262
Reputable Member
 

Is there any issue booting the subject machine to Kali in forensic mode ( I note paladin above) and just connecting a USB drive and imaging to that, thereby only using one machine and eliminating the tableau?

That depends on what version of Kali do you use and how do you boot it. If you use a full version of Kali, then booting it in the forensic mode will sync RAID1-like LVM volumes on source drives (if they are present in the system, of course). This doesn't happen in a light version of Kali (no LVM driver there).

And another example if you boot Kali from a USB HDD or a USB stick certified for Windows To Go, then an unclean (not properly unmounted) Ext4 file system on a source drive will be automatically recovered, even in the forensic mode.

 
Posted : 21/04/2016 1:46 am
mokosiy
(@mokosiy)
Posts: 54
Trusted Member
 

Perhaps our company's product may be helpful to you. We have a specially designed adapter for Apple SSD image acquisition Apple PCIe SSD extension module

What's good about it the module reads drive model and serial number, supports damaged drives.

However, using the Apple PCIe SSD module demands to purchase the whole Atola Insight Forensic.

 
Posted : 21/04/2016 3:02 pm
Page 1 / 2
Share: