Has anyone done an IMac G4 acquisition? I have one involved in an upcoming case and am looking for a heads up before I go onsite. Any guideance appreciated.
Best advice, Target Disk Mode is your friend. Hold down the "t" key during bootup and it will go into TDM, the screen should show the firewire symbol. The caveat with that is you will only see the master drive in a multiple drive system, at least that was my experience in the only case I imaged a G4 with multiple drives, but if I remember correctly, the IMac only has one hard drive and it is pretty difficult to get to.
Also, you may want to bring multiple laptops (with firewire connections) because I have had situations where one laptop would recognize the drive when set in TDM, but another laptop would not.
Once you are connected and your system recognizes the attached device, you should be able to use your imager of choice to acquire the data. I have had success using FTK Imager, Encase, dd in linux, and SMART Forensics
Good Luck.
Matt
Deckard,
Just as a precautionary measure it is best to boot the Mac using the 'option' key first (ALT) key. This will tell you if the open firmware is password protected or not. If it is you may not be able to use FTM and the Mac would ignore you pressing the 'T' key and boot from the OS. Look out for a padlock or similar symbol when booting with the option key as this will tell you the open firmware is locked.
Steve
Yank the drive.
It is an easy removal. 4 initial screws, 2 adapters, and 4 more screws and you are in business.
Most all the G4's I have done have pretty large drives and are SATA so have a SATA blocker handy. Best compression could put you around the 8 hour mark.