For instructions on doing a live acquisition on a machine that is running, click HERE. For instructions on acquiring RAM click HERE. This is not a tutorial on seizure practices, but it is assumed that if the computer is on at time of seizure, it will be handled as such, with imaging of RAM, and potential imaging of a live system being the way to proceed. First and foremost, we must determine if the computer is on or not. There are some necessary steps to perform prior to actually starting your collection.
FUSION EXTERNAL DRIVES FOR MAC HOW TO
This tutorial assumes that you already know how to image the drives individually, and you can see a tutorial of this HERE. There are commands to rejoin the two drives into a single fusion drive after the fact, but they have mixed reviews as to the success rate.
That is why, when faced with a fusion drive scenario you should absolutely image the virtual fusion drive, and it is recommended that you also image each of the physical drives separately. That being said, if the SSD is 128 GB, it will reserve a portion for working space, and this portion does NOT get imaged when imaging the fusion drive. It then starts prioritizing data to keep on the SSD. No data ever actually gets to the HDD until the SSD fills up. This is a virtual drive created by system that incorporates both drives. In a fusion drive system, the user only sees one hard drive. This is not to be confused with two separate drives, or with a RAID system. The SSD gives the system its speed, while the HDD gives it ample storage space. One solid state drive, and one traditional rotating media drive. The Fusion drive consists of actually 2 hard drives.
FUSION EXTERNAL DRIVES FOR MAC MAC
Without going into great detail, Fusion drive is a technology used by Apple in its iMac line of computers, as well as its Mac line. With FileVault enabled, you cannot extract a usable image without them. This tutorial also assumes that you have the necessary credentials to access the device. It is assumed that you are already aware of them, and will follow them in every case. This tutorial does not get into evidence intake procedures. If this is your first time dealing with acquisition of Mac computers, now is not the time to practice on a real case. If, after reading this, there are still things you don’t understand, STOP before you START. This tutorial is about as simple and “step-by-step” as it gets. Read all instructions FIRST, before attempting. Instructions and screen shots are from El Capitan. This has NOT been tested on every Apple OS, but I have tested it on Mountain Lion, Mavericks, Yosemite, and El Capitan. The instructions below are designed to create a forensic image of a Mac Computer with Fusion drive via the command line and Target Disk Mode, so that you don’t have to spend piles of money on acquisition programs. PI, GSEC, GCFE, GCFA, EnCE, BAI, CDRP, CEH
0 kommentar(er)
