±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35745
New Yesterday: 2 Visitors: 121

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

MacBook Pro (model A1708) with iOS. Need to acquire image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

pbmattingly
Newbie
 

MacBook Pro (model A1708) with iOS. Need to acquire image

Post Posted: Oct 12, 18 12:18

What I have done so far. There is no password on firmware. Put the laptop in target disk mode. Connected a 3.0 usb-c cable to the laptop while the other end of the cable is usb and connected that into my forensic machine. The laptop does not appear in my drop down in FTK Imager to acquire the drive. Can't use Paladin because there is no usb port on the laptop. I also tried using a write blocker as well as a software write blocker thinking maybe the laptop will appear in FTK Imager, but it didn't as well. Not sure what else I should do. The hard drive is soldered onto the motherboard.  
 
  

minime2k9
Senior Member
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Oct 12, 18 12:35

You need an adapter that converts the USB C port on the laptop to a USB-C port and 2 USB ports. This is available from Apple (about £50) or you can get 3rd party ones that have the same capability.

Then you can boot to your chosen imaging tool (personally macquisition for this) and image it as normal Smile

Apple one:
Here

3rd Party one:
Here

Just beware, sometimes 3rd party ones won't boot properly because Apple stuff is just a pain for playing with anything else.  
 
  

bkkchop
Newbie
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Oct 15, 18 18:46

I agree with minime2k9, an adapter to convert USB-C is almost a must. In my Mac cases, I've used both Paladin and Macquisition, they both work fine.  
 
  

mawk
Newbie
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Nov 09, 18 16:59

To me that adapter looks like it will enable you to project the video to a VGA monitor.

If I connected that adapter to the apple source computer, how would I go about connecting and getting the drive to show up on my window based Forensic machine so that i could make an image using Imager?
Thanks  
 
  

Dimi
Member
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Nov 10, 18 12:05

I don't work for SUMURI, and so i don't make money with it, but this could be a solution.

sumuri.com/product/pal...pro-7-usb/  
 
  

KishorSarma
Newbie
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Dec 06, 18 11:58

HI, There are few options you can try....
You can not directly connect and Image your MacBook. If you have disk duplicator like Tableau TX1 then you can connect your MacBook in target mode and have a image of the same.
Other option is you can boot it with other boot media, Paladin, CAIN, Macquisition etc and have a forensic image of the same.
You will need USB converter and USB Hub for the same.  
 
  

JaredDM
Senior Member
 

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Dec 06, 18 16:03

According to Apple, Target Disk Mode should work over USB C on these newer laptops. However, I think it might only work connected to another Mac, not connected to a PC. I suspect it's using some non-standard type of USB communication since TDM typically only works over Firewire or Thunderbolt.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 

Page 1 of 1