New Macbook Air

Keep in mind that these support booting from remote CD/DVD's.

Install this if you are on Windows (already have it if you are using OSX)
http//support.apple.com/kb/DL112

Create a closed WiFi network.

Insert the bootable CD/DVD forensic distro of your choice.

Boot the Air holding Option, connect to the closed WiFi network and the remote disk will appear as a bootable optical drive. Boot and image just like you would anything else.

Keep in mind that these support booting from remote CD/DVD's.

Install this if you are on Windows (already have it if you are using OSX)
http//support.apple.com/kb/DL112

Create a closed WiFi network.

Insert the bootable CD/DVD forensic distro of your choice.

Boot the Air holding Option, connect to the closed WiFi network and the remote disk will appear as a bootable optical drive. Boot and image just like you would anything else.

Have you tried this? From the instructions that Apple gives they only reference the remote installer application, which I suspect is locked to Apple's boot disks.

Well I'm due to get my 11 inch MB Air next week, I'll let you all know how it goes with some other boot options. p

But at least this time around we have 2 usb ports and not one…

Tom

Am I safe in assuming that Macquisition will work on this device? If so problem solved.

This is why we recommended to field staff to remove the SSD or HD and image using a Tableau and the appropriate ZIF adapter.

Out of interest, have you found a LIF adapter for, I think, 2nd Generation Airs ? As you say ZIF's are used on 1st generations and i think 3rd

We have one but it was put together by one of our data recovery engineers. It isn't pretty but it does the job.

Just written something about this today

http//www.computer-forensics.co.uk/computer-forensics-forums/entry.php?6-Acquiring-Those-Pesky-Macbook-Air-Drives

Just doing some quick research on the Macbook Air3,1 (Late 2010) and how it would be possible to acquire it.

According to ifixit MacBook Air 11" tear down (http//www.ifixit.com/Teardown/MacBook-Air-11-Inch-Model-A1370-Teardown/3745/1) the SSD interface is mSATA (micro SATA).

I'm wondering if Tableau's micro SATA adaptor (http//www.tableau.com/index.php?pageid=products&model=TDA3-1) is compatible this particular SSD drive.

I don't have a new MBA to try this on but I'm wondering if this method works.

Nick

I've got a friend who has one of the new Macbook Airs and hates it and will be selling it. Does anybody have any suggestions on how to wipe the internal SSD?

I'm thinking that using Apple's Disk Utility to wipe it would "probably" be good enough, but I'm not 100% sure if this would work with an SSD. As an alternative, I might try to boot into a Linux distro and then write /dev/random to /dev/sda but figured a Mac expert here would know best.

Thanks!

I've got a friend who has one of the new Macbook Airs and hates it and will be selling it. Does anybody have any suggestions on how to wipe the internal SSD?

I'm thinking that using Apple's Disk Utility to wipe it would "probably" be good enough, but I'm not 100% sure if this would work with an SSD. As an alternative, I might try to boot into a Linux distro and then write /dev/random to /dev/sda but figured a Mac expert here would know best.

Thanks!

My review of wear leveling schemes leads me to believe that there may be some data still hanging about even after a wipe. The random writes probably won't make a difference as the mapping scheme for wear leveling resides in the SSD controller and it is possible that some of the previous written data that has been moved is out there somewhere. The question is how do you recover the migrated now latent data if the controller has isolated the "levelled" physical sectors.

Why not just boot the Mac from the included USB software restore stick, run Disk Utility and wipe the drive? Disk Utility gives you several options to erase and overwrite.

I've got a friend who has one of the new Macbook Airs and hates it and will be selling it. Does anybody have any suggestions on how to wipe the internal SSD?

I'm thinking that using Apple's Disk Utility to wipe it would "probably" be good enough, but I'm not 100% sure if this would work with an SSD. As an alternative, I might try to boot into a Linux distro and then write /dev/random to /dev/sda but figured a Mac expert here would know best.

Thanks!

As soon as I saw this post, my initial thought was also F-Response. It's probably the quickest way to achieve a physical image if it's already on and connected to a network (which lets face it… thats the whole point) and you are ready to go and don't even need to shut down.

I probably wouldn't be pulling the thing apart and battling with connectors unless you were in a situation where it was switched off and away from the original network it connects to and you wanted to avoid making changes like booting and connecting to a NEW network.

If you are doing it in place, F-Response it.