mac book air and ma...
 
Notifications
Clear all

mac book air and mac book pro forensic acquisition

7 Posts
7 Users
0 Reactions
630 Views
(@sebastianorossi)
Trusted Member
Joined: 14 years ago
Posts: 85
Topic starter  

I talked to an apple store. They say in the mac book air there is a solid state disk. Which is the best ways to extract it? i have got
only ide/sata wiebetch adaptor and wiebetech USB adaptor.
And, what's inside a mac book pro?


   
Quote
(@chrisb55755)
New Member
Joined: 14 years ago
Posts: 1
 

There are two methods that i generally use. The first is Macquisition by BlackBag Technologies. It comes on a flash drive and you can boot directly from it. For me this is the best method, but Access Data also has a Mac Command line version of Imager that works well generally that is available for free on their site.


   
ReplyQuote
(@eyez0n)
Eminent Member
Joined: 18 years ago
Posts: 29
 

Forward Discovery's Raptor 2.5 can image MacBook Airs. However, we have not had success doing so from a bootable USB drive. Instead we had to use a DVD.

Here is a link to someone who has posted their method (same that we use). Good luck!

http//forensicir.blogspot.com/2009/07/unsung-tools-raptor-forensics.html


   
ReplyQuote
(@davidkoepi)
Active Member
Joined: 15 years ago
Posts: 9
 

one alternative is to put mac into target disk mode and connect (writeblock )it to your acquisition machine.


   
ReplyQuote
Beetle
(@beetle)
Reputable Member
Joined: 17 years ago
Posts: 318
 

one alternative is to put mac into target disk mode and connect (writeblock )it to your acquisition machine.

This only works with FireWire and Thunderbolt


   
ReplyQuote
nlpd120
(@nlpd120)
Trusted Member
Joined: 15 years ago
Posts: 96
 

Try Sumuri's Paladin (Disc or USB). There may be an issue with Paladin not seeing the internal drive. A solution if you encounter this from the Forum Administrator at Sumuri

"You may have to Select "Start with safe options" on boot."

If you have an issue with Paladin I suggest you sign up on the Sumuri Forum and post your question there. Let me know if it worked with or without the safe options.

Thank you,

Chris Currier


   
ReplyQuote
Novunix
(@novunix)
Eminent Member
Joined: 16 years ago
Posts: 35
 

I have used NBCaine successfully on acquiring both macbook air and pro with solid state drives.

Download it free and then dd the image to a suitably sized USB drive and let 'er rip 😉

Many other tools including Raptor, FTK, Paladin and Helix among them, failed to capture an image completely.

NBCaine -> http//www.caine-live.net/page5/page5.html

/neo


   
ReplyQuote
Share: