Acquiring a MacOS System with Target Disk Mode - Revision history

Joachim Metz at 05:52, 11 August 2012

2012-08-11T05:52:28Z

Joachim Metz at 05:50, 3 August 2012

2012-08-03T05:50:23Z

Joachim Metz at 05:50, 3 August 2012

2012-08-03T05:50:10Z

Joachim Metz at 05:49, 3 August 2012

2012-08-03T05:49:23Z

Joachim Metz at 05:49, 3 August 2012

2012-08-03T05:49:04Z

Joachim Metz: /* Acquisition */

2012-08-03T05:47:43Z

‎Acquisition

Joachim Metz at 05:43, 3 August 2012

2012-08-03T05:43:25Z

Joachim Metz at 05:36, 3 August 2012

2012-08-03T05:36:35Z

Joachim Metz at 05:36, 3 August 2012

2012-08-03T05:36:16Z

Joachim Metz at 05:35, 3 August 2012

2012-08-03T05:35:54Z

← Older revision		Revision as of 05:52, 11 August 2012
Line 1:		Line 1:
		+	{{Wikify}}
		+
	Make sure to [[Disabling_Macintosh_Disk_Arbitration_Daemon\|disable the disk arbitration daemon]] on the machine where you will do the acquisition. Alternatively use a FireWire [[Write Blockers\|write blocker]]		Make sure to [[Disabling_Macintosh_Disk_Arbitration_Daemon\|disable the disk arbitration daemon]] on the machine where you will do the acquisition. Alternatively use a FireWire [[Write Blockers\|write blocker]]

@@ Line 5: / Line 5: @@
 Note the sizes of all drives on your forensic Mac, if you don't already know. To find out go to:
 <pre>
-Apple menu > About This Mac > More info > ATA.
+Apple menu > About This Mac > More info > ATA
 </pre>

@@ Line 3: / Line 3: @@
 Prepare a clean firewire drive format is as [[HFS+]] using Mac Disk Utility; name the volume “Target”. This process relies on being able to identify which drive is the suspect's drive by knowing its size. Many new Macs are shipping with 250GB drives. Having a unique firewire target drive size will help you identify it later, as you will see below.
-Note the sizes of all drives on your forensic Mac, if you don't already know. To find out:
+Note the sizes of all drives on your forensic Mac, if you don't already know. To find out go to:
 <pre>
-Go to the Apple menu > About This Mac > More info > ATA.
+Apple menu > About This Mac > More info > ATA.
 </pre>

@@ Line 8: / Line 8: @@
 </pre>
-== Connecting the suspect's drive ==
+== Connecting the suspect drive ==
 . Without turning anything on, connect the forensic Mac to the suspect’s computer using a firewire cable.
@@ Line 29: / Line 29: @@
 . Assuming that no password was needed, hold down the “T” key and turn the suspect’s computer back on. The computer will eventually display the firewire logo on the screen and is then ready for TDM.
-== Acquiring the suspect's drive ==
+== Acquiring the suspect drive ==
 . Turn on the acquiring Mac (with the disk arbitration daemon disabled)

@@ Line 8: / Line 8: @@
 </pre>
-== Connecting the suspect drive ==
+== Connecting the suspect's drive ==
 . Without turning anything on, connect the forensic Mac to the suspect’s computer using a firewire cable.
@@ Line 29: / Line 29: @@
 . Assuming that no password was needed, hold down the “T” key and turn the suspect’s computer back on. The computer will eventually display the firewire logo on the screen and is then ready for TDM.
-=Acquisition=
+== Acquiring the suspect's drive ==
 . Turn on the acquiring Mac (with the disk arbitration daemon disabled)

@@ Line 83: / Line 83: @@
 Notice that slice '''3''' is 114.4 GB in size. Slice 3 is the “working area” on this 120G drive and is the slice that you will make available for receiving your evidence, using the mount command shown in green in line 8 below.
-  <table width="700" border="0" cellspacing="1" cellpadding="15">
+. Once you confirm which drive is which, you are ready to go. Lets assume that your forensic drive is '''disk0''', the suspect’s drive is '''disk1''', and the Target drive is '''disk2'''.
-    <tr class="Section1">
-      <td width="4">&nbsp;</td>
+. Because we turned off disk arbitration, however, the target drive isn't available to receive the image. We therefore need to mount the '''Target drive'''; specifically slice '''3''' of '''disk2'''.
-      <td width="633" align="left" valign="top"><ol start=7 type=1>
-          <li>Once you confirm which drive is which, you are ready to go. Lets assume that your forensic drive is <b>disk0</b><span style='font-weight:normal'>, the suspect’s drive is </span><span style='color:red'><b>disk1</b></span>, and the Target drive is <span style='color:blue'><b>disk2</b></span>.</li>
-        </ol>
-        <ol start=8 type=1>
-          <li>Because we turned off disk arbitration, however, the target drive isn't available to receive the image. We therefore need to mount the <span style='color:blue'><b>Target</b></span> drive; specifically slice <span style='color:lime'><b>3</b></span> of <span
-     style='color:blue'><b>disk2</b></span>. </li>
-      </ol></td>
-    </tr>
-  </table>

@@ Line 1: / Line 1: @@
-First, [[Disabling_Macintosh_Disk_Arbitration_Daemon|disable the disk arbitration daemon]] on the machine where you will do the acquisition.
+Make sure to [[Disabling_Macintosh_Disk_Arbitration_Daemon|disable the disk arbitration daemon]] on the machine where you will do the acquisition. Alternatively use a FireWire [[Write Blockers|write blocker]]
-Prepare a clean firewire drive in HFS+ using Mac Disk Utility; name the volume “Target”. This process relies on being able to identify which drive is the suspect's drive by knowing its size. Many new Macs are shipping with 250GB drives. Having a unique firewire target drive size will help you identify it later, as you will see below.
+Prepare a clean firewire drive format is as [[HFS+]] using Mac Disk Utility; name the volume “Target”. This process relies on being able to identify which drive is the suspect's drive by knowing its size. Many new Macs are shipping with 250GB drives. Having a unique firewire target drive size will help you identify it later, as you will see below.
-Note the sizes of all drives on your forensic Mac, if you don't already know. (Go to the Apple menu>About This Mac>More info>ATA.)
+Note the sizes of all drives on your forensic Mac, if you don't already know. To find out:
-==Connecting==
+<pre>
-. Without turning anything on, chain the forensic Mac to the firewire drive to the suspect’s computer using  firewire cables.
+Go to the Apple menu > About This Mac > More info > ATA.
 . Hold down the “Option” key on the suspect’s computer and turn it on.
@@ Line 11: / Line 15: @@
 . If the suspect’s computer '''does not''' ask for a password, then '''turn it off'''. If the computer '''does''' ask for a password, then '''turn it off'''. You cannot do a simple TDM acquisition if a password is required. You will have to either:
-a. remove the drive and do a direct acquisition; or,
+a. remove the drive and do a direct acquisition
 b. modify the memory by adding or removing chips and zapping the PRAM.

@@ Line 8: / Line 8: @@
 . Hold down the “Option” key on the suspect’s computer and turn it on.
 . If the suspect’s computer '''does not''' ask for a password, then '''turn it off'''. If the computer '''does''' ask for a password, then '''turn it off'''. You cannot do a simple TDM acquisition if a password is required. You will have to either:
-## remove the drive and do a direct acquisition; or,
+  # remove the drive and do a direct acquisition; or,
-## modify the memory by adding or removing chips and zapping the PRAM.
+  # modify the memory by adding or removing chips and zapping the PRAM.
 <pre>