±Your Account
Membership:
New Today: 0
New Yesterday: 5
Overall: 24179
Visitors: 41±Latest Webinar
±Latest Articles
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
FAT32
I have found a few hidden files that I dont think were there the last time I was imaging with the HDD:
.com.apple.timemachine.donotpresent
._.com.apple.timemachine.donotpresent
edit: just googled it and these files are present to disable a mac backup popup when the device is plugged in. I'll try deleting them and see if it makes a difference. I doubt it will, but the only thing it will definitely change is making the popup show.
edit2: Just tried deleting all of the Mac temp files and no luck. And even though I deleted the timemachine files, there was still no popup.
Mac FTK Imager issue
Mac FTK Imager issue
Posted: Fri Jul 08, 2011 4:47 pm
I am currently trying to image two MacBook Pro laptops (v 10.5 and newer) with FTK. When I begin the imaging, the e01 file is saved to my HDD as a hidden file. Does anyone know why this would be happening and what I can do to fix it? The same problem has occured with two different laptops using two different HDDs. I have used the same HDDs for previous collections and this did not happen. It isn't a huge problem, but it is pretty annoying and I'm curious as to why it's happening. Thanks in advance for any help!
Also, please let me know if I have posted this in the wrong forum, and if so what forum would be better to post a question like this.
Also, please let me know if I have posted this in the wrong forum, and if so what forum would be better to post a question like this.
-

Fernesics - Member
-

Beetle - Senior Member
Re: Mac FTK Imager issue
Posted: Fri Jul 08, 2011 5:35 pm
- BeetleWhat file system are you imaging to?
FAT32
I have found a few hidden files that I dont think were there the last time I was imaging with the HDD:
.com.apple.timemachine.donotpresent
._.com.apple.timemachine.donotpresent
edit: just googled it and these files are present to disable a mac backup popup when the device is plugged in. I'll try deleting them and see if it makes a difference. I doubt it will, but the only thing it will definitely change is making the popup show.
edit2: Just tried deleting all of the Mac temp files and no luck. And even though I deleted the timemachine files, there was still no popup.
-

Fernesics - Member
Re: Mac FTK Imager issue
Posted: Sat Jul 09, 2011 6:48 am
Those files are how the FAT drivers Apple uses deals with the resource fork of native Mac files. The dot preceding the names hide the files from the Finder. I would look carefully at your output path to see if there might be a stray dot in front of the name assigned to the image that is masking the name. I assume that the image files are hidden to the Finder and visible under Windows(?).
-

Beetle - Senior Member
Re: Mac FTK Imager issue
Posted: Sun Jul 10, 2011 6:40 am
.........when I image Macs I always save them to an HFS formated external drive & never had a problem.
-

Redcelica67 - Senior Member
Re: Mac FTK Imager issue
Posted: Mon Jul 11, 2011 11:02 am
Problem solved. It ended up being a combination of outdated guides and a brain fart on my part.
I've been learning to image and it had been a while since I used FTK so I quickly looked over the guide to get a refresher, which threw me off. Please know that posting here wasn't the first thing I had done (I had exhausted all of the options I could think of at that point) and that I appreciate you all posting here.
Thank you all for the help and the suggestions!
I've been learning to image and it had been a while since I used FTK so I quickly looked over the guide to get a refresher, which threw me off. Please know that posting here wasn't the first thing I had done (I had exhausted all of the options I could think of at that point) and that I appreciate you all posting here.
Thank you all for the help and the suggestions!
-

Fernesics - Member
















