Mac Imaging

How to image a Mac with a Live Linux bootable USB

This post walks through how to create a bootable USB with CAIN.Once created, the USB can be used to boot the MAC and mount the internal drive read only so an image can be created.


How to image a Mac using Singer User Mode

This post walks through how to boot into Single User Mode on a Mac. Once in Single user mode a disk image can be created. If the Mac is encrypted with FileVault, the drive is mounted in an un-encrypted state after a username and password are supplied. This allows the examiner to create an unecrypted image of the partition without booting into the operating system.


Mac Live Imaging

This post walks though how to create a live image of a Mac, including one encrypted with FileValult

Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux 

What happens if you have an image of an encrypted Mac? This post walks though how to mount it in Linux. Once the password is supplied it can be mounted in an unencrypted state and then reimaged so it can be used in tools that don't support FileVault encryption, such as X-Ways.

No comments:

Post a Comment