Join Us!

Imaging a MacBook A...
 
Notifications
Clear all

Imaging a MacBook Air  

  RSS
dror
 dror
(@dror)
New Member

Hi
I need to Imaging a MacBook Air.
to eo1 or dd.
I use Paladin but it does not recognize the source disk.
Does anyone have any idea what to use.
Thanks

Quote
Posted : 01/04/2020 1:40 pm
giandega
(@giandega)
Active Member

Try Caine or tsurugi linux

ReplyQuote
Posted : 01/04/2020 2:06 pm
giandega
(@giandega)
Active Member

I am not sure but in 2018 deft zero was optimized for MAC. Try here http//na.mirror.garr.it/mirrors/deft/zero/deftZ-2018-2.iso

ReplyQuote
Posted : 01/04/2020 2:23 pm
dror
 dror
(@dror)
New Member

I tried Caine
It also does not recognize the internal disk
Thanks

ReplyQuote
Posted : 01/04/2020 2:31 pm
minime2k9
(@minime2k9)
Active Member

DEFT Or Macquisition will work.
Need something with nvme support.

ReplyQuote
Posted : 01/04/2020 4:27 pm
dror
 dror
(@dror)
New Member

Sorry
I tried DEFT
It's stuck on a blue screen for a long time after the main screen

ReplyQuote
Posted : 01/04/2020 4:33 pm
LeGioN
(@legion)
Member

If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )

ReplyQuote
Posted : 02/04/2020 7:07 am
nightworker
(@nightworker)
Active Member

open it use rstudio for mac and acquire not forensically sound but it works
create a video and write it down on your report

ReplyQuote
Posted : 02/04/2020 9:34 pm
jjcardiff
(@jjcardiff)
New Member

If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )

I second this method, works every time for me when plugged directly into a hardware imager via thunderbolt or firewire (if available)

ReplyQuote
Posted : 03/04/2020 12:57 pm
Share: