±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35530
New Yesterday: 1 Visitors: 97

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Apple T2 Chip 2018 model Macbook and iMac

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

dandaman_24
Senior Member
 

Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Oct 29, 18 21:50

Im testing a Macbook Pro 2018 model, OS version 10.13.6 which has a T2 chip.

I have tried booting to Macquisition (latest version), however the Mac will not allow it to boot. I have disabled secure boot, allowing boot media to be run from a external source, just shows the prohibited symobl.

I have booted it into target disk mode and connected another 2018 Macbook with T2 and also a 2017 Macbook to it via USB C whilst running Macquisition. Still no luck.


Having looked online there are many posts on various geek forums, none appear to have come up with an answer.

Anyone here have anyluck ?

Thanks  
 
  

minime2k9
Senior Member
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Oct 30, 18 08:19

I haven't had one of those devices through yet, but have you tried contacting manufacturer?
They are pretty good for issues like this.  
 
  

dandaman_24
Senior Member
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Oct 30, 18 09:24

I tired to contact Tim Cook at Apple, he hasn't returned my call yet, I guess he's busy today. Laughing

I have spoken to some Blacklight trainers and they are in the dark too at the moment.  
 
  

dandaman_24
Senior Member
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Oct 30, 18 20:14

See below link to Apples paper on the T2 chip

www.apple.com/euro/mac...erview.pdf  
 
  

dandaman_24
Senior Member
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Nov 09, 18 15:16

Update

It seems after booting the Macbook into Target Disk Mode (TDM) i connected a generic thunderbolt cable Embarassed Embarassed .

I have since purchased a thunderbolt 3 cable, Macbook in TDM and my forensic mac booted to Macquisiton to enable write blocking and the Mac then pops up on my Forensis machine for acquisition.


So it does work, just make sure you use thunderbolt 3 cable.  
 
  

lammy_uk
Newbie
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Nov 28, 18 14:20

Can you tell me if the test machine you were acquiring had FileVault II enabled or not? If so, at what point (if any) were you prompted to enter the password by MacQuisition?
Thanks  
 
  

dandaman_24
Senior Member
 

Re: Apple T2 Chip 2018 model Macbook and iMac

Post Posted: Nov 28, 18 17:15

Yes it had fv2.

Macquisiton will tell you if the drive you wish to acquire is encrypted. The macquisiton manual tells you all about how to acquire and decrypt with the password.  
 

Page 1 of 2
Page 1, 2  Next