How to image a Mac with a Live Linux bootable USB
This post walks through how to create a bootable USB with CAIN.Once created, the USB can be used to boot the MAC and mount the internal drive read only so an image can be created.
How to image a Mac using Singer User Mode
This post walks through how to boot into Single User Mode on a Mac. Once in Single user mode a disk image can be created. If the Mac is encrypted with FileVault, the drive is mounted in an un-encrypted state after a username and password are supplied. This allows the examiner to create an unecrypted image of the partition without booting into the operating system.
Mac Live Imaging
This post walks though how to create a live image of a Mac, including one encrypted with FileValult
Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux
What happens if you have an image of an encrypted Mac? This post walks though how to mount it in Linux. Once the password is supplied it can be mounted in an unencrypted state and then reimaged so it can be used in tools that don't support FileVault encryption, such as X-Ways.
How to mount a Mac APFS Image in Windows
This walks through how to mount a Mac image in windows
No comments:
Post a Comment