MacBook Pro (model ...
 
Notifications
Clear all

MacBook Pro (model A1708) with iOS. Need to acquire image

8 Posts
8 Users
0 Likes
3,519 Views
(@pbmattingly)
Posts: 2
New Member
Topic starter
 

What I have done so far. There is no password on firmware. Put the laptop in target disk mode. Connected a 3.0 usb-c cable to the laptop while the other end of the cable is usb and connected that into my forensic machine. The laptop does not appear in my drop down in FTK Imager to acquire the drive. Can't use Paladin because there is no usb port on the laptop. I also tried using a write blocker as well as a software write blocker thinking maybe the laptop will appear in FTK Imager, but it didn't as well. Not sure what else I should do. The hard drive is soldered onto the motherboard.

 
Posted : 12/10/2018 12:18 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

You need an adapter that converts the USB C port on the laptop to a USB-C port and 2 USB ports. This is available from Apple (about £50) or you can get 3rd party ones that have the same capability.

Then you can boot to your chosen imaging tool (personally macquisition for this) and image it as normal )

Apple one
Here

3rd Party one
Here

Just beware, sometimes 3rd party ones won't boot properly because Apple stuff is just a pain for playing with anything else.

 
Posted : 12/10/2018 12:35 pm
(@bkkchop)
Posts: 4
New Member
 

I agree with minime2k9, an adapter to convert USB-C is almost a must. In my Mac cases, I've used both Paladin and Macquisition, they both work fine.

 
Posted : 15/10/2018 6:46 pm
 mawk
(@mawk)
Posts: 2
New Member
 

To me that adapter looks like it will enable you to project the video to a VGA monitor.

If I connected that adapter to the apple source computer, how would I go about connecting and getting the drive to show up on my window based Forensic machine so that i could make an image using Imager?
Thanks

 
Posted : 09/11/2018 3:59 pm
 Dimi
(@dimi)
Posts: 13
Active Member
 

I don't work for SUMURI, and so i don't make money with it, but this could be a solution.

https://sumuri.com/product/paladin-pro-7-usb/

 
Posted : 10/11/2018 11:05 am
(@kishorsarma)
Posts: 1
New Member
 

HI, There are few options you can try….
You can not directly connect and Image your MacBook. If you have disk duplicator like Tableau TX1 then you can connect your MacBook in target mode and have a image of the same.
Other option is you can boot it with other boot media, Paladin, CAIN, Macquisition etc and have a forensic image of the same.
You will need USB converter and USB Hub for the same.

 
Posted : 06/12/2018 10:58 am
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

According to Apple, Target Disk Mode should work over USB C on these newer laptops. However, I think it might only work connected to another Mac, not connected to a PC. I suspect it's using some non-standard type of USB communication since TDM typically only works over Firewire or Thunderbolt.

 
Posted : 06/12/2018 3:03 pm
(@gapodaca)
Posts: 14
Active Member
 

I know this may be a stupid question but how do I image an older MBP (retina, late-2012) in TDM if I'm doing so from a newer MBP (2018)? Both are APFS. Also, if I have a TX1 imager, and am trying to create a logical image of the older MBP, is it true I can only do so in .LX01?

I tried connecting the newer MBP to the TX1 earlier and was unable to get it to recognize the MBP. I'll try connecting it to the older one tomorrow and report back. As the most recent reply states, it may have to do with TDM only working over Firewire or Thunderbolt, but I have a USB-C hub similar to the apple one, I just need to figure out the right combination.

 
Posted : 13/08/2019 11:55 pm
Share: