Powerbook G4 and TD...
 
Notifications
Clear all

Powerbook G4 and TDM

3 Posts
3 Users
0 Reactions
359 Views
(@pbeardmore)
Reputable Member
Joined: 18 years ago
Posts: 289
Topic starter  

I have just received one of these. Previously, I have reached for the screwdrivers and pulled the drive out. But I want to have a try with TDM for the first time and want to check a couple of things.
Is it correct that TDM puts the drive into Read Only status? or is there another command?
For belt and braces, is there a writeblocker out there for firewire devices?
Thanks for any advice


   
Quote
Beetle
(@beetle)
Reputable Member
Joined: 17 years ago
Posts: 318
 

It won't be read only. I assume that you are hooking it up to another Mac? If so you need to (re)move the diskarbitationd.plist file

The suggested commands for Tiger on your analysis machine are

sudo cp /etc/mach_init.d/diskarbitrationd.plist /Backup/

sudo rm /etc/mach_init.d/diskarbitrationd.plist

These copy the disk arbitration file to a safe location and then deletes the one that is read by the kernel on boot.

A good guide can be found here http//www.macosxforensics.com/Downloads/files/MacForensics.pdf

I think there are some firewire blockers on the Blackbag Technologies site.


   
ReplyQuote
Webbie
(@webbie)
Eminent Member
Joined: 20 years ago
Posts: 29
 

Another link regarding FWTDM -

http//www.blackbagtech.com/support/documents.htm


   
ReplyQuote
Share: