We’ll walk you through how to first lessen the risk of tampering with a laptop’s insides by securing a forensic image outside of BitCurator.
That leaves us with using either a Mac or Linux machine to create our backup of the Mac laptop in our example, I used a Mac to create the backups.
It’s possible you could get around this issue by using other virtualization software, but VirtualBox is the best free/open-source option. I’ve read that commercial software called MacDrive (currently about $50 for use on one PC) will let you connect the a Mac in target disk mode to a PC, but this would not make the Mac drive also available in the Windows computer’s BitCurator VM unfortunately, VirtualBox is unable to take firewire input. Target disk mode works with other Macs (perhaps obviously) and Linux machines I wasn’t able to get a Windows machine to recognize the Mac laptop in target disk mode. Note that the issue complicating this imaging process is specific to Mac laptops Linux and Windows laptops wouldn’t require target disk mode and the trouble that causes. You can also opt to make a forensics image outside BitCurator and then import the image into BitCurator for exploration. In that case, you may want to open the laptop to temporarily remove the hard drive for forensic imaging within the BitCurator environment, which means you’ll need a cable that connects a hard drive to your imaging computer (probably a SATA cable). We recognize that you might not have the correct devices on hand to follow the instructions in the previous post. The Mac laptop we wanted to forensically image. If your workspace doesn’t have the necessary tools to follow that tutorial (a firewire cable, a firewire port on the Mac you’re imaging, and a firewire port on a PC partitioned with BitCurator), we offer an alternative in this post. Last week, I wrote about how to forensically image the internal hard drive on a Mac laptop without needing to physically remove the drive.
0 kommentar(er)
