Notifications
Clear all

Paladin acquisition

3 Posts
3 Users
0 Likes
1,180 Views
(@pbmattingly)
Posts: 2
New Member
Topic starter
 

What I have done so far. There is no password on filevault. I have connected a macbook pro laptop using a usb c port hub so I could acquire an image. I'm able to use Paladin v7.01 but was only able to acquire the smaller partition. There should be another partition but it doesn't appear. Why is that? What is the work around. The SSD for the MacBook pro is 500GB.

 
Posted : 29/10/2018 2:59 pm
 dega
(@dega)
Posts: 261
Reputable Member
 

Hi try to use deft zero 2018. Has supporta for mac

http//www.deftlinux.net/2018/09/01/deft-zero-2018-2-ready-for-download/

 
Posted : 29/10/2018 6:51 pm
(@randomaccess)
Posts: 385
Reputable Member
 

If Paladin doesn't have support (you should image disk0 and then you may need to use a mac to mount and review the data. Or blacklight if it's apfs encrypted).

If you're not seeing any of the disks then Recon Imager or Macquisition may be of use; whilst they arent free, they're pretty reliable

 
Posted : 30/10/2018 5:59 am
Share: