Hi
I need to Imaging a MacBook Air.
to eo1 or dd.
I use Paladin but it does not recognize the source disk.
Does anyone have any idea what to use.
Thanks
Try Caine or tsurugi linux
I am not sure but in 2018 deft zero was optimized for MAC. Try here http//
I tried Caine
It also does not recognize the internal disk
Thanks
DEFT Or Macquisition will work.
Need something with nvme support.
Sorry
I tried DEFT
It's stuck on a blue screen for a long time after the main screen
If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )
open it use rstudio for mac and acquire not forensically sound but it works
create a video and write it down on your report
If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )
I second this method, works every time for me when plugged directly into a hardware imager via thunderbolt or firewire (if available)