We have used powered USB hubs and then booted from a USB CD/DVD drive to image MacBook Air's to external USB drives. The imaging was done with both Raptor 2.5 (free) and Macquisition (not free).
I have heard of the method mentioned by E5PRO but have not tried it. However, a colleague whom I respect quite a bit for his forensic abilities said he has used that method with success.
Let us know what works for you.
Hidden data battery investigations
Due to a common embedded controller found in Lithium Ion (Li-Ion) and Lithium
Polymer batteries and used in a large number of MacBook, MacBook Pro, and MacBook Air laptop computers it is possible when the battery is 'unsealed' to conceal data in its memory.
To avoid data being lost at the next boot up…..
http//
I have recently conducted a few examinations on a number of the early 2012 Apple devices (including the newer Macbook Air's and a couple of the newer iMacs) and I had a few issues similar to some of those that have been mentioned.
One of the main issues I have come across is the Blackbag Macquisition software having limitations on newer models of Macbooks (again including the newest of the Air series). Apparently they have released a new command line work around for their issues although, as I am currently waiting for my copy to arrive, I have been unable to verify and test this work around.
The other main issues I have been experiencing have been with boot discs; Helix, Raptor etc. The most up-to-date versions of these boot discs, in my experience, do not work on the newest versions of the Apple hardware. The bests disc for anyone out there to try for themselves would be the new Deft disc (v7.1 I believe); this disc has worked brilliantly for me. It is a forensic build with a decent array of forensic tools to use (dcfldd, guymager etc).
It works incredibly well on the older Macbook Air models however on the newer models I have had some issues in launching the GUI. This was, however, reasonably easy to work around using the command line imaging tools provided.
A couple of things to note would be that only an Apple branded optical drive would work (….thanks Apple) and a powered USB hub might be needed on certain models in order to connect your external storage device (to image to).
Also the newer Macbook Air's have moved away from the SSD's with the ZIF connections and have started to use a version of SATA that appears to be bespoke to their small Samsung (or Toshiba) drives (the connection looks like a smaller version of mSATA).
Adapters for this form factor have started to appear but so far I have not been able to test them, if anyone else has I would be interested in knowing whether they work???
http//