Target Disk Mode on...
 
Notifications
Clear all

Target Disk Mode on Lenovo/HP?

2 Posts
2 Users
0 Likes
1,467 Views
(@thepm)
Posts: 253
Reputable Member
Topic starter
 

Has someone tried connecting to a Mac in Thunderbolt Target Disk Mode using a non-Apple laptop equipped with a Thunderbolt port?

I know that some new laptops have a Thunderbolt port (like Lenovo W540 and HP ZBook 15). I would like to know if it works because I need to refresh some of our forensic laptops this year and Apple now only offers 15" laptops with Retina Display (no Superdrive, no Ethernet, no FireWire, sucky Windows Thunderbolt support, etc.) So I would like to avoid buying those laptops.

The problem is that I have yet to find a solution to be able to mount a Thunderbolt equipped Mac on a PC in read-only mode to perform triage and/or imaging. The Tableau T9 does not work if I use a Thunderbolt / FireWire adapter on the suspect side.

So, I'm wondering if connecting my Thunderbolt TDM Mac to a Thunderbolt equipped PC laptop would allow me to triage a Mac computer in Windows? I don't have such a laptop and my boss might not want me to spend 2000$ on a laptop for testing… -)

Thanks

 
Posted : 04/03/2014 7:57 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

There are as I see it two potential issues. 😯

The first one is that seemingly an issue exists that prompted to make the Thunderbolt device only detectable at boot time (i.e. no "hot-plug")
http//www.tomshardware.com/reviews/thunderbolt-performance-z77a-gd80,3205.html
(it is very possible that in the time passed the BIOS/UEFI/whatever has been fixed)

See also this
http//www.forensicfocus.com/Forums/viewtopic/t=7285/

The second is that for Windows 7 (I believe that only starting from Windows 7 Thunderbolt drivers are available) the target disk mode is most probably "simply" an external disk, so that there are possible unintentional writes issues.

The possible solution to the above would be a Thunderbolt write blocker, possibly the Logicube Falcon with a (planned) add-on PCIe card may do, but it seems to me like it is mostly a "theoretical" idea, where "Thunderbolt" was added to get more search engine hits
http//www.logicube.com/shop/falcon/

On the other hand, one could use a WinFE
http//winfe.wordpress.com/
instead of a "real" Windows 7/8/8.1 OS, but again the whole Thunderbolt business (and the installation in the PE environment of the suitable drivers) is so new/rare that I doubt that any experiment has been made on it.

All in all it would be really nice if you could convince your boss to spend wink if not the whole 2,000 bucks at least around 1,300 for an Asus, and see what happens, example
http//www.amazon.com/ASUS-G750JW-DB71-17-3-Inch-Laptop-Black/dp/B00COQIKB4

jaclaz

 
Posted : 04/03/2014 11:46 pm
Share: