MacBook Pro (model ...
 
Notifications
Clear all

MacBook Pro (model A1708) with iOS. Need to acquire image  

  RSS
pbmattingly
(@pbmattingly)
New Member

What I have done so far. There is no password on firmware. Put the laptop in target disk mode. Connected a 3.0 usb-c cable to the laptop while the other end of the cable is usb and connected that into my forensic machine. The laptop does not appear in my drop down in FTK Imager to acquire the drive. Can't use Paladin because there is no usb port on the laptop. I also tried using a write blocker as well as a software write blocker thinking maybe the laptop will appear in FTK Imager, but it didn't as well. Not sure what else I should do. The hard drive is soldered onto the motherboard.

Quote
Posted : 12/10/2018 1:18 pm
minime2k9
(@minime2k9)
Active Member

You need an adapter that converts the USB C port on the laptop to a USB-C port and 2 USB ports. This is available from Apple (about £50) or you can get 3rd party ones that have the same capability.

Then you can boot to your chosen imaging tool (personally macquisition for this) and image it as normal )

Apple one
Here

3rd Party one
Here

Just beware, sometimes 3rd party ones won't boot properly because Apple stuff is just a pain for playing with anything else.

ReplyQuote
Posted : 12/10/2018 1:35 pm
bkkchop
(@bkkchop)
New Member

I agree with minime2k9, an adapter to convert USB-C is almost a must. In my Mac cases, I've used both Paladin and Macquisition, they both work fine.

ReplyQuote
Posted : 15/10/2018 7:46 pm
mawk
 mawk
(@mawk)
New Member

To me that adapter looks like it will enable you to project the video to a VGA monitor.

If I connected that adapter to the apple source computer, how would I go about connecting and getting the drive to show up on my window based Forensic machine so that i could make an image using Imager?
Thanks

ReplyQuote
Posted : 09/11/2018 3:59 pm
Dimi
 Dimi
(@dimi)
New Member

I don't work for SUMURI, and so i don't make money with it, but this could be a solution.

https://sumuri.com/product/paladin-pro-7-usb/

ReplyQuote
Posted : 10/11/2018 11:05 am
KishorSarma
(@kishorsarma)
New Member

HI, There are few options you can try….
You can not directly connect and Image your MacBook. If you have disk duplicator like Tableau TX1 then you can connect your MacBook in target mode and have a image of the same.
Other option is you can boot it with other boot media, Paladin, CAIN, Macquisition etc and have a forensic image of the same.
You will need USB converter and USB Hub for the same.

ReplyQuote
Posted : 06/12/2018 10:58 am
JaredDM
(@jareddm)
Active Member

According to Apple, Target Disk Mode should work over USB C on these newer laptops. However, I think it might only work connected to another Mac, not connected to a PC. I suspect it's using some non-standard type of USB communication since TDM typically only works over Firewire or Thunderbolt.

ReplyQuote
Posted : 06/12/2018 3:03 pm
gapodaca
(@gapodaca)
New Member

I know this may be a stupid question but how do I image an older MBP (retina, late-2012) in TDM if I'm doing so from a newer MBP (2018)? Both are APFS. Also, if I have a TX1 imager, and am trying to create a logical image of the older MBP, is it true I can only do so in .LX01?

I tried connecting the newer MBP to the TX1 earlier and was unable to get it to recognize the MBP. I'll try connecting it to the older one tomorrow and report back. As the most recent reply states, it may have to do with TDM only working over Firewire or Thunderbolt, but I have a USB-C hub similar to the apple one, I just need to figure out the right combination.

ReplyQuote
Posted : 14/08/2019 12:55 am
Share: