Macbook Air Acquisition

isth · 2011-06-14T04:08:02Z

Hi All,I just acquired one of these and wanted to share my findings. This was a newer Macbook Air with 2 USB ports-Raptor allows you to boot into the machine but does not recognize the SSD drive.-Paladin allows you to boot into the machine but does not recognize the SSD drive. This one shouldn't have been a surprise but the website clearly states "Boot standard PCs and Intel Macs in a forensically sound manner (including the MacBook Air)" so I was hoping that one would intend to image the mac after booting into it forensically.-LinEn allows you to boot into the machine but does not recognize the SSD drive.I ended up using FTK Imager for Mac GUI (http//www.appleexaminer.com/Utils/Downloads.html) to perform a live acquisition. It took about 2 hours to capture/transfer the 128GB drive to a USB2.0 external drive.I am also told that EncasePortable will do the job (using the boot CD, as it won't boot of USB drive).Hope this helps some people in the future!

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Bulldawg 14 years ago

21 Posts

14 Users

0 Reactions

6,115 Views

RSS

Bulldawg

(@bulldawg)

Estimable Member

Joined: 14 years ago

Posts: 190

06/12/2012 3:52 am

I do not have two Macs with Thunderbolt to test this it, but I can tell you that a thunderbolt-only MacBook with a Thunderbolt to Firewire adapter will work in Target Disk Mode when connected to a computer with a Firewire port.

If that helps.

ReplyQuote

Page 3 / 3 Prev