Acquisition

Once you have decided that an image of a Macintosh is necessary, there are many valid and forensically sound methods for acquiring a complete physical image of a Macintosh computer. This page will serve as an outline of the methods available.
Sponsored Advertisement

Target Disk Mode
Apple has built-in to all late model Macintosh computers, a technology found in no other personal computer, Target Disk Mode. This technology allows the Macintosh to become an external Firewire hard drive providing access to the contents contained within. This technology is available on the following Macintosh models according to Apple’s Support website, Article HT1661:

Apple provides an import “Tip” in Article HT1661 regarding Target Disk Mode. It reads as follows:

Tip: FireWire Target Disk Mode works on internal ATA drives only. Target Disk Mode only connects to the master ATA drive on the Ultra ATA bus. It will not connect to Slave ATA, ATAPI or SCSI drives.



What this note means to us: The Power Mac, Mac Pro and XServe all support multiple internal hard drives. If you have multiple ATA drives inside of these models, Target Disk Mode will only make the “master” drive available. The Power Mac shipped with IDE as a standard and SCSI as an option. Mac Pros and XServes ship with SATA or SAS drives and they will all appear in Target Disk Mode. If the person has installed additional drives that use SCSI or IDE, you may not get the whole picture presented in Target Disk Mode.

Once you have determined that Target Disk Mode is for you, here is how to use it:

  1. Power on the Macintosh and IMMEDIATELY hold down the Option key.
  2. This will cause the Macintosh to boot to either the “Startup Manager” or “Open Firmware Password”
  3. If you are presented with the bootable partitions, you successfully booted to the Startup Manager. Power Off the Mac by holding down the Power button until shut down.
  4. If you are presented with a Lock with password dialog box, you have booted to Open Firmware Password. You cannot boot to Target Disk Mode until you remove this password. This is done by changing the amount of physical RAM in the Mac and reseting the PRAM. This also resets the clock so weigh the consequences carefully to your own case.
  5. Once you have shut down the Mac and determined Target Disk Mode will be available, Power it back on and this time, immediately hold down the “T” key.
  6. You should now see the Firewire symbol floating around the screen. This indicates the Macintosh is in Target Disk Mode. You can now insert a Firewire cable into the target Mac and connect it to your acquisition computer.

Windows Tip for Target Disk Mode Acquisitions
Windows users have long been plagued with the problem of Macs in Target Disk Mode not showing up as a device. There is a fix for this. Using Regedit, we need to remove the 1394 (Firewire) entry. Here is how:

In Windows (of course)
  1. Click on Start -> Run and type “regedit” and click on Ok.
  2. In Regedit, navigate to the key, “My Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum” and delete the entry for “1394”
  3. Exit Regedit.

Changes to the Registry are live and there should be no need to reboot your system. The entry for 1394 will be recreated as new Firewire devices are connected.

What should your Acquisition computer be?

A Mac

A PC

What file format should you acquire to?

Of course this is a personal choice but consider this:

What do I do if Target Disk Mode is not an Option?

Your next best option is using a Live CD to boot the target Macintosh, and perform the acquisition to an external hard drive. Using this method, you will use a CD that contains an operating system to boot the Macintosh. This CD should contain an operating system that has been modified to be forensically sound such that is won’t modify the contents of the Mac in any way.

Your choices for this include:

You will need an external hard drive that is larger than the internal disk of the target Mac to guarantee adequate space for acquisition to complete. To use a Live CD as a boot disc, use the following steps:

  1. Power on the Macintosh and IMMEDIATELY hold down the Option key.
  2. This will cause the Macintosh to boot to either the “Startup Manager” or “Open Firmware Password”
  3. If you are presented with the bootable partitions, you successfully booted to the Startup Manager. Insert your Live CD. If it does not automatically show, click the rescan arrow.
  4. If you are presented with a Lock with password dialog box, you have booted to Open Firmware Password. You cannot boot to a Live CD until you remove this password. This is done by changing the amount of physical RAM in the Mac and reseting the PRAM. This also resets the clock so weigh the consequences carefully to your own case.
  5. If you have determined that you can boot from a Live CD, connect you external drive here, prior to booting from the Live CD.
  6. Select your Live CD to boot from.

Note: Your external hard drive should be formatted such that your destination analysis machine can read the contents! If you plan to acquire the Mac using a Live CD such as Raptor, you will be able to use an external drive that is formatted Mac OS Extended (No Journaling Enabled), NTFS and FAT32. If you acquire to a Mac OS Extended file system and then connect to a Windows system, your Windows system will not be able to read the contents of the drive! (MacDrive 7 for Windows fixes this but it costs money)

What if a Live CD is not an option?

Here, you are probably stuck taking the Mac apart to gain access to the physical hard drive. A fabulous website to assist you in taking apart Macs is the iFixit website (http://www.ifixit.com) where their step-by-step guides will show you, down to the last screw, how to get hard drives out of every Macintosh model made! With the hard drive removed, you are free to acquire using any write-blocked method you have traditionally used for any hard drive.