Fusion Drivesįusion drive is the combination of an ordinary drive and a small NAND flash drive as well that appear as one logical volume in the OS, but when you try imaging it, you’ll get two different drives and the image will be somewhat corrupted for the analysis tools if you don’t assemble it correctly.

Prevents the host computer from writing data to the target macbook when using Target Disk Mode. So, trying to use the cable that came with the charger shouldn’t work since it supports USB 2.0 transfer only. usb-c charging cable provided is only usb2.0 for data transfer to do thunderbolt target disk mode you need a thunderbolt 3 cable (expensive) Supports live imaging of Apple Silicon Macs! Target Disk ModeįileVault 2 Target Disk Mode Unlock Using the Personal Recovery Key. Sounds made up, but Mac forensics expert said that this is what it looks like now.Īlso, they talked about ITR tool that images and triages Mac devices. That means than if there is someone with Bluetooth enabled on the crime scene, the owner of the evidence (Mac device) can send a command to wipe his notebook leveraged through the investigator’s Bluetooth. There used to be some disk mode in which one could perform imaging, but now it doesn’t work without a passcode as well.Īnother interesting key point is that now the kill signal can be sent over Bluetooth as well. At the moment, Mac forensics resembles iOS forensics in that there is probably little you can do without a password. But after T2 Mac imaging has become even more painful since it’s impossible to image a drive without a password and another Mac even if File Vault is turned off. Samuri stumbled upon it and they had to work this out. But then they’ve added Fusion Drives which was quite a trouble for analysts. Below I am listing some key points not to forget and to work on them later.Īt first, Mac imaging was no different from imaging other devices running other OS (Windows or Linux). I’ve recently listened to DFSP podcast in which Steve Wahlen talked about different caveats in Mac forensics.

Target disk mode usb c