±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 36595
New Yesterday: 5 Visitors: 150

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Macquisition and T2 chipped Macbook imaging problems

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Adam10541
Senior Member
 

Macquisition and T2 chipped Macbook imaging problems

Post Posted: Feb 12, 20 08:16

The search function of this site appears to not be working so apologies if there is already a thread on this one.

I have a newer Macbook with the T2 chip on board and having some issues acquiring.

I've got an admin password so have been able to disable the secure boot options so I can (supposedly) boot from USB. I have the latest version of Macqusition (2019.R1.2) which they claim is capable of processing the T2 macbooks.

I can run Macquisition live from the booted system, however there appears to be some system settings which mean you cannot acquire the image from a live environment. Macquisition documentation says this is because the system drive is mounted read/write and it needs to be read only for the acquisition to work. Okay so then the next option is to boot the Macbook with the Macquisition dongle.

All appears to go well but then the Macquisition logo just sits on the screen and the little progress bar fills up to 100% then nothing further happens. Appears to hang and never progresses any further.

Does anyone have any experience with the new T2 Macbooks?  
 
  

SecretSquirrel01
Newbie
 

Re: Macquisition and T2 chipped Macbook imaging problems

Post Posted: Feb 12, 20 11:42

We encountered a couple of issues with one of the newer MacBook Pros a couple of weeks ago; your issue sounds similar to one that we had:
Issue 1 (main point): We were getting the BlackBag loading screen and our loading bar was also hanging. After a little while we tried our second dongle which then loaded up straight away. After re-applying the latest update to the first dongle using the Macquisition updater app, it now also loads up successfully - so maybe an issue with the dongle rather than the Mac?

Issue 2 (food for thought): The target MacBook Pro wasn't supported for conventional Macquisition as it was a late 2019 model. It was however supported for Target Disk Mode acquisition using our DFU Mac - worth consideration if you've also got a bang up to date Mac to examine.

If compatibility does also happen to be an issue - it sounds as though Macquisition 2020 will be released in the not so distant future.

(https://www.blackbagtech.com/products/macquisition/macquisition-compatibility-requirements/)
(https://support.blackbagtech.com/hc/en-us/articles/360029366571-Imaging-a-Mac-via-Target-Disk-Mode)  
 
  

Adam10541
Senior Member
 

Re: Macquisition and T2 chipped Macbook imaging problems

Post Posted: Feb 13, 20 06:29

Thanks Squirrel, BB support suggested reinstalling the dongle, to be fair I thought that sounded a bit far fetched as the dongle is the latest version but I'll give that a try and see what happens.

I do have another Mac running 10.14 so should be up to date enough for the target disk mode.....now just trying to find an old thunderbolt 2 cable is the challenge Smile

Update: reinstalling the dongle did the trick. Not sure why exactly because the versions were the same, but happy to report am able to now boot via USB on the target machine and imaging off to an ext USB drive. Thanks again Squirrel.  
 

Page 1 of 1