I examined a recent 27" iMac with two internal hard drives. Target Disk Mode only shows the first drive. Booting with Raptor or every other forensic distro I tried only shows the first drive. Even fdisk -l and hdparm cannot see the second drive.
Taking apart iMacs is difficult and there is the possibility of damaging the iMac, especially with the delicate foil wrapped around the inside of the monitor casing.
There is no indication anywhere on the exterior of the iMac that there are two hard drives present.
This is a situation that can lead to serious errors if an acquisition is made and the examiner doesn't realize there is a second hard drive present.
Does anyone know a way to detect a second drive in an iMac? The only ways I know of are opening the case and booting into the system's OSX OS, which is not usually advisable because you will be changing timestamps and other artifacts on the system.
Are the disks RAID-0, so logically only one disk will appear?
Do you know what capacity the disks are? Does this tie up with the logical disk size seen by OS/X?
Sorry if the first part seems patronising but I reccomend research with any Apple product. I am sure you will find out how many drives should be in the device by doing some research.
When it comes to removing the drives I always watch YouTube first. You can watch the latest Apple products being taken apart and follow the video when you do it yourself.
Here is an example.
http//
I would never choose a Sony or Apple computer if I needed to get into it quickly.
Best of luck with your examination.
Bootable USB Mac drive / Poratble OS X Workstaion?
http//
Stinks of Apple RAID configuration. I have had several tools miss this on Mac servers. Good thing about those of course is that you can see the mirrored drive easily with the side of the case off.
BlackBag's tools can be a good solution as well.
Just to follow up, the drives were NOT in a RAID. There was a 500GB SATA OS drive and a 1TB SATA data drive mounted to /Users/(username)
Great link, Doug. I wonder if Disk Arbitrator has been tested running as a login item to start write blocking before OSX has a chance to touch the drive.
One surefire way to check this is to run Diskutility from the installer disk, if you have access to one. This will show you all the drives on a Mac including the opticals.
The newer imacs are offered with a combination of hdd and sdd on the Apple store and there is no mention of two hdds being available whatsoever. I am not sure you could squeeze two hdds in there.
My first reaction to your description is a Filevault configuration.