Imaging a MacBook A...
 
Notifications
Clear all

Imaging a MacBook Air

9 Posts
6 Users
0 Likes
2,530 Views
 dror
(@dror)
Posts: 3
New Member
Topic starter
 

Hi
I need to Imaging a MacBook Air.
to eo1 or dd.
I use Paladin but it does not recognize the source disk.
Does anyone have any idea what to use.
Thanks

 
Posted : 01/04/2020 12:40 pm
 dega
(@dega)
Posts: 261
Reputable Member
 

Try Caine or tsurugi linux

 
Posted : 01/04/2020 1:06 pm
 dega
(@dega)
Posts: 261
Reputable Member
 

I am not sure but in 2018 deft zero was optimized for MAC. Try here http//na.mirror.garr.it/mirrors/deft/zero/deftZ-2018-2.iso

 
Posted : 01/04/2020 1:23 pm
 dror
(@dror)
Posts: 3
New Member
Topic starter
 

I tried Caine
It also does not recognize the internal disk
Thanks

 
Posted : 01/04/2020 1:31 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

DEFT Or Macquisition will work.
Need something with nvme support.

 
Posted : 01/04/2020 3:27 pm
 dror
(@dror)
Posts: 3
New Member
Topic starter
 

Sorry
I tried DEFT
It's stuck on a blue screen for a long time after the main screen

 
Posted : 01/04/2020 3:33 pm
LeGioN
(@legion)
Posts: 51
Trusted Member
 

If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )

 
Posted : 02/04/2020 6:07 am
nightworker
(@nightworker)
Posts: 134
Estimable Member
 

open it use rstudio for mac and acquire not forensically sound but it works
create a video and write it down on your report

 
Posted : 02/04/2020 8:34 pm
socratescymru
(@socratescymru)
Posts: 13
Eminent Member
 

If the MacBook Air is pre T2 (Before 2018) it should be possible to image it by putting it in target mode and image it with for example ftk imager. )

I second this method, works every time for me when plugged directly into a hardware imager via thunderbolt or firewire (if available)

 
Posted : 03/04/2020 11:57 am
Share: