±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34850
New Yesterday: 1 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

MacBook Pro (model A1708) with iOS. Need to acquire image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

MacBook Pro (model A1708) with iOS. Need to acquire image

Post Posted: Fri Oct 12, 2018 6:18 am

What I have done so far. There is no password on firmware. Put the laptop in target disk mode. Connected a 3.0 usb-c cable to the laptop while the other end of the cable is usb and connected that into my forensic machine. The laptop does not appear in my drop down in FTK Imager to acquire the drive. Can't use Paladin because there is no usb port on the laptop. I also tried using a write blocker as well as a software write blocker thinking maybe the laptop will appear in FTK Imager, but it didn't as well. Not sure what else I should do. The hard drive is soldered onto the motherboard.  

pbmattingly
Newbie
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Fri Oct 12, 2018 6:35 am

You need an adapter that converts the USB C port on the laptop to a USB-C port and 2 USB ports. This is available from Apple (about £50) or you can get 3rd party ones that have the same capability.

Then you can boot to your chosen imaging tool (personally macquisition for this) and image it as normal Smile

Apple one:
Here

3rd Party one:
Here

Just beware, sometimes 3rd party ones won't boot properly because Apple stuff is just a pain for playing with anything else.  

minime2k9
Senior Member
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Mon Oct 15, 2018 12:46 pm

I agree with minime2k9, an adapter to convert USB-C is almost a must. In my Mac cases, I've used both Paladin and Macquisition, they both work fine.  

bkkchop
Newbie
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Fri Nov 09, 2018 9:59 am

To me that adapter looks like it will enable you to project the video to a VGA monitor.

If I connected that adapter to the apple source computer, how would I go about connecting and getting the drive to show up on my window based Forensic machine so that i could make an image using Imager?
Thanks  

mawk
Newbie
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Sat Nov 10, 2018 5:05 am

I don't work for SUMURI, and so i don't make money with it, but this could be a solution.

sumuri.com/product/pal...pro-7-usb/  

Dimi
Member
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Thu Dec 06, 2018 4:58 am

HI, There are few options you can try....
You can not directly connect and Image your MacBook. If you have disk duplicator like Tableau TX1 then you can connect your MacBook in target mode and have a image of the same.
Other option is you can boot it with other boot media, Paladin, CAIN, Macquisition etc and have a forensic image of the same.
You will need USB converter and USB Hub for the same.  

KishorSarma
Newbie
 
 
  

Re: MacBook Pro (model A1708) with iOS. Need to acquire imag

Post Posted: Thu Dec 06, 2018 9:03 am

According to Apple, Target Disk Mode should work over USB C on these newer laptops. However, I think it might only work connected to another Mac, not connected to a PC. I suspect it's using some non-standard type of USB communication since TDM typically only works over Firewire or Thunderbolt.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 

JaredDM
Senior Member
 
 

Page 1 of 1