? I have a question for the Mac gurus here.
I received a macbook that was shut down on day 1.
On day 2 the macbook was placed into target disk mode and imaged.
as I look at the .e01s I see that over 22,000 files had the day 2 date stamp on them.
I can only assume that a write blocker was used.
I believe the MB has OSx v 10.6
My question is
When a mac is placed into Target Disk Mode does the hard drive get written to at that time?
I have not encountered writes to the subject drive when using Target Disk Mode unless the person doing the acquisition had an oops moment and did not get TDM activated on the first try or they did not write block the drive.
I believe with TDM there are writes to the drive but nothing to major files.. It is more low level writing as a write blocker does..
So it could be a Opps moment as bithead said.. I've had a few moments like that where firmware issues on a all in one would not see keyboards attached and I couldn't use TDM or single user mode..
It threw me for a loop after trying 2 different keyboards to acquire a mac.. Very annoying failing 2 attempts of trying to be forensically sound..