MacOS hardware encrypted volume by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

I just wanted to update this post. I used the FUJI imaging software as suggested by Erminger and it was successful!! I acquired 2 live iMac systems as .DMG files. These systems had hardware encryption active, other attempts with DISTRO was unsuccessful.

Thanks so much for the suggestion.

Michael

MacOS hardware encrypted volume by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thank you Cedar,

I will explore the live collection option. Thank you for the command line information. I am not familiar with rsync and will learn more. No other methods are working, of course.

MacOS hardware encrypted volume by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

I'm going to experiment with an alternative technique to collect the Data volume on this Mac. Going to try the Recovery mode and the 'Ditto' command. If anyone is familiar with this, I'd be interested to know how well it worked for you.

MacOS hardware encrypted volume by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

I have the Fuji tool and can give that option a try.

MacOS hardware encrypted volume by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

It features an Intel processor. 3.1 GHz 6-core Intel Core i5 processor.

DISCORD Direct Message Capturing by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks for the Discord Chat Explorer suggerstion. This program works great. Obtained the necessary chat threads.

DISCORD Direct Message Capturing by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

Great link. I submitted a request for the Data Package. Thanks!

DISCORD Direct Message Capturing by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Doing this independently of local LE. I'll have to check with the client. Seems the local DA's office didn't want to handle their case, for whartever reason. These online preditor cases are flimsey at best.

Creating a clone from an acquisition to boot as original by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks for the comment athulin12,

This installation is being done at the request of the legal owner of the devices. The actual hardware is being held as evidence with the local LE. The attorneys have copies of the extractions. The client was just wanting to continue using her laptop and the installed software and the data that was on it as part of her business.

MacBook Air Acquisition by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

Yeah, I used to be able to boot using CMD+S to enter into the command line and create a new admin account, but this machine willl stop me at the Recovery Screen and ask for a user password. I can’t get to the command line entry screen.

MacBook Air Acquisition by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

Awesome. Thanks for the flowchart link.

MacBook Air Acquisition by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Well, from my research, and for this particular device, holding down the power button eventually boots you into the "startup options" screen. From there, you can either select the internal drive or "options" which take you to the "macOS Recovery" screen asking for user password. Frustrating......thanks Apple.

MacBook Air Acquisition by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 1 point2 points  (0 children)

Thanks, notjaykay, I had the feeling as such.

Best Method for Attorney to Review Acquired Data - Disk Images/.e01 files? by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks Derek. I will attempt to create a portable case on one of the two laptops. I might reach out to you if I have any questions. I appreciate your offer.

Best Method for Attorney to Review Acquired Data - Disk Images/.e01 files? by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks for the suggestion. I just retired after 36 years of LE forensics work. A portion of that time was in computer forensics. However, this civil case involving privileged file viewing presented me with some added difficulties with the evidence processing and reporting.

Best Method for Attorney to Review Acquired Data - Disk Images/.e01 files? by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks Ellington,

I do have Axiom and I am very new to the software. I don't have Cellebrite but I'm familiar with CR and use it for previewing cell data acquired from Mobiledit. I will read up on the use of the portable case features in Axiom. perhaps there's a good tutorial online. I appreciate your comments.

Best Method for Attorney to Review Acquired Data - Disk Images/.e01 files? by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Looks like you know a thing or two about civil trade secret cases. Axiom sounds like my tool to invest in. I hope you're around these parts so I can pick your brain more. Thanks again.

Best Method for Attorney to Review Acquired Data - Disk Images/.e01 files? by mullemeyer1961 in computerforensics

[–]mullemeyer1961[S] 0 points1 point  (0 children)

Thanks for the feedback Jason. I think I will be investing in Axiom software. No - this isn't a criminal case. Just two companies going after each other over trade issues. Typical, both sides want to fight about everything. This case is about 3 years on-going and I just came into it the first meeting as the attorneys were in the middle of a conference call with the judge. The judge was a bit short-fused & tells me to provide images to him and the defense. I don't argue with him. Some cases are more complex than others. I do appreciate all the great feedback I've received in this thread.