±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 5
Overall: 24179
Visitors: 41

Mac FTK Imager issue

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Mac FTK Imager issue

Post Posted: Fri Jul 08, 2011 4:47 pm

I am currently trying to image two MacBook Pro laptops (v 10.5 and newer) with FTK. When I begin the imaging, the e01 file is saved to my HDD as a hidden file. Does anyone know why this would be happening and what I can do to fix it? The same problem has occured with two different laptops using two different HDDs. I have used the same HDDs for previous collections and this did not happen. It isn't a huge problem, but it is pretty annoying and I'm curious as to why it's happening. Thanks in advance for any help!

Also, please let me know if I have posted this in the wrong forum, and if so what forum would be better to post a question like this.  

Fernesics
Member
 
 
  

Re: Mac FTK Imager issue

Post Posted: Fri Jul 08, 2011 5:21 pm

What file system are you imaging to?  

Beetle
Senior Member
 
 
  

Re: Mac FTK Imager issue

Post Posted: Fri Jul 08, 2011 5:35 pm

- Beetle
What file system are you imaging to?


FAT32

I have found a few hidden files that I dont think were there the last time I was imaging with the HDD:

.com.apple.timemachine.donotpresent

._.com.apple.timemachine.donotpresent

edit: just googled it and these files are present to disable a mac backup popup when the device is plugged in. I'll try deleting them and see if it makes a difference. I doubt it will, but the only thing it will definitely change is making the popup show.

edit2: Just tried deleting all of the Mac temp files and no luck. And even though I deleted the timemachine files, there was still no popup.  

Fernesics
Member
 
 
  

Re: Mac FTK Imager issue

Post Posted: Sat Jul 09, 2011 6:48 am

Those files are how the FAT drivers Apple uses deals with the resource fork of native Mac files. The dot preceding the names hide the files from the Finder. I would look carefully at your output path to see if there might be a stray dot in front of the name assigned to the image that is masking the name. I assume that the image files are hidden to the Finder and visible under Windows(?).  

Beetle
Senior Member
 
 
  

Re: Mac FTK Imager issue

Post Posted: Sun Jul 10, 2011 6:40 am

.........when I image Macs I always save them to an HFS formated external drive & never had a problem.  

Redcelica67
Senior Member
 
 
  

Re: Mac FTK Imager issue

Post Posted: Mon Jul 11, 2011 11:02 am

Problem solved. It ended up being a combination of outdated guides and a brain fart on my part.

I've been learning to image and it had been a while since I used FTK so I quickly looked over the guide to get a refresher, which threw me off. Please know that posting here wasn't the first thing I had done (I had exhausted all of the options I could think of at that point) and that I appreciate you all posting here.

Thank you all for the help and the suggestions!  

Fernesics
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1