Creating a forensic image of a MacBook Pro

preview_player
Показать описание

This is how a forensic image is created of a MacBook. This method also applies to T2 and soldered SSD macbooks.

Yes, my videos are long but If you want to jump around the video, below you can find the timestamps:

0:00 Intro
0:40 Case du jour
2:26 Forensic Imaging process
4:32 Loading image into Magnet Axiom
9:50 Magnet results
12:14 Final words

-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
Some of the tools that we use:

ruSolut Monolith adapter
ruSolut eMMC Adapters
ruSolut TSOP adapter
ruSolut Visual Nand Reconstructor
FlashExtractor
Z3X EasyJtag + UFS
JBC NANO
Hakko Soldering Iron FM-203
Hakko Rework Station 810B
Quick 8610W Rework Station
ACHI IR6500 BGA Station
PC-3000 UDMA
PC-3000 Portable III +SSD and nVMe
DeepSpar 3
DeepSpar 4
DeepSpar DPI PCI-E NVME Addon
DeepSpar Forensic Addon
DeepSpar Network Addon
ZXW Tools
Adobe Premiere CC
Adobe Photoshop CC
Camtasia Studio

Cellebrite UFED (Latest Version)
MSAB XRY
Magnet Forensics IEF
Magnet Axiom
X-Ways
FTK Imager
Various Linux Distros
-------------------------------------------------------------------------------------
Music:

-------------------------------------------------------------------------------------

All graphics created by Data Rescue Labs

Need data recovery service? Forensic service?

Data Rescue Labs Inc
145 Traders Blvd East Unit 8
Mississauga, Ontario
L4Z 3L3
Canada

Copyright (c) Data Rescue Labs Inc 2021
1-877-681-4131

#verbatim #usb #flash #stick #howto
Рекомендации по теме
Комментарии
Автор

Very informative, adds a whole dimension to data recovery.

DiskTuna
Автор

Yess It's interesting
Looking forward for more forensic tools

mihirkadam
Автор

I won't mind having a tour of Data Rescue Lab one day!

Lexzee_Lee
Автор

Hellow my friend.

Forensics is the best.
Another amazing video, thanks.

:)

cocobongo
Автор

Hello, I am a forensic analyst and we're trying to figure out how to successfully image the newest mac devices. Most of them now have the T2 chips that encrypt the machine at rest. would you be able to make a video on how to image the newest mac computers? Thank you!

brycegnatek
Автор

Please did you do the video on AXIOM as promised?

romeojosuekuemeningounou
Автор

what is the purpose of using this software?

jameslau
Автор

When an extraction on a phone is made, can you also access data from the cloud like Google or Apple even if the extraction is offline?

Mitikinho
Автор

I have a MacBook without t2 but with failevault enabled, password unknown, I have acquired the HDD but it's obviously encrypted, do I need to bruteforce? Are there other ways?

davidhasseloff
Автор

On what type of memory does "usb being plugged in" stores on a mac or pc? And does that get deleted after a format?

sergiomancia
Автор

Do you have your own forensics company?

batmanasdasd
Автор

Hi, May I know where can I purchase that Blackbag technologies MacQuisition?

maripazfernandez
Автор

Hello
Can we analyze the image with Autopsy?

pepegrillo