±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 0 Visitors: 117

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Image of MacBook Pro

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

roncufley
Senior Member
 

Image of MacBook Pro

Post Posted: Nov 17, 19 10:17

Guys, I need some help, please.

I am attempting to obtain a forensic image of a MacBook Pro using X-Ways imager. I have connected the Mac to my PC using FireWire. Everything connects up ok and I boot the Mac to Target Disk Mode. X-Ways can see the Mac disk as a physical disk so everything should work, however as soon as I plug the power supply into the Mac I can no longer read the disk and it disappears from the Device Manager on the PC.

It all works fine on the battery but, of course, it does not last long enough for a full image.

Do you guys have any ideas?

Regards
Ron Cufley
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 
  

dandaman_24
Senior Member
 

Re: Image of MacBook Pro

Post Posted: Nov 17, 19 11:28

If you can't power and image at the same time. Charge the battery so full, boot to a reputable Mac imaging software and acquire the Macintosh HD partition only. You may have a 1tb SSD, only 100gb may be in use, so imaging this will be quicker and your battery shouldn't run out....hopefully.  
 
  

jahearne
Member
 

Re: Image of MacBook Pro

Post Posted: Nov 20, 19 19:05

Make sure you are using quality cables. I have had issues with USB hubs when attempting to image a MacBook. Not all hubs are equal.  
 
  

roncufley
Senior Member
 

Re: Image of MacBook Pro

Post Posted: Nov 20, 19 20:58

Thanks Guys, I now have the image. I used a different PC, different software and a different cable and it worked at last.
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 

Page 1 of 1