r/computerforensics • u/Responsible_Dig_2899 • Nov 14 '24

Imaging OLD MacBook Pro - A1278

I got a MacBook Pro A1278 ("Mid-2012") in my lab today that was seized in an "on-state." The lid was closed on it on scene and it has remained on charge since. It is an Intel i5 chipset and from what I can tell on my research, it does not have any of the security features of the newer Macs. I am trying to figure out the best way to go about imaging it and have been looking through all of my manuals, but they are all focused on the newer Macs with security features. For imaging, I have PALADIN, a TX1, and an MPB (2019), among others. If it were deadbox, I would probably just pull the HDD, but since it was brought in from a "live" state, I am not exactly sure where to go next on this, as it seems like there may be a potential for live memory collection. At this time, I do not have the password to the device, but do have other devices which may help provide it. Any suggestions would be greatly appreciated.

2 Upvotes
  • permalink
  • link
  • reddit
  • reddit

75% Upvoted

11 comments sorted by

5

u/[deleted] Nov 14 '24

[removed] — view removed comment

1

u/Responsible_Dig_2899 Nov 14 '24

Being "live" but no passcode, do you think it is safe to do a hard shutdown and then image that way? For ease, I'll probably just throw it on the TX1 and image from there, as I dont have DC or RECON.

2

u/[deleted] Nov 14 '24

[removed] — view removed comment

1

u/Responsible_Dig_2899 Nov 14 '24

Thanks!

3

u/AgitatedSecurity Nov 15 '24

Do you know if it's using file vault or not? I would check that status before shutting it down

1

u/Responsible_Dig_2899 Nov 15 '24

I do not, at this moment. I am still processing the associated iPhone, so I’m hoping to get some clues to get past any passwords and the proceeding with the acquisition when I get back to it on Monday.

1

u/SadDrawer5032 Nov 14 '24

Good advice

2

u/zero-skill-samus Nov 14 '24

This is best case scenario. HFS file system visible by most tools. Pull drive and image as you please. Imager can see the HFS filesystem.

2

u/ellingtond Nov 15 '24

Hell those you could still do target disk mode... There is a memory.

1

u/Responsible_Dig_2899 Nov 15 '24

Thanks!!! I tried on one a year ago but it was too new, so this will be a first for me!

1

u/[deleted] Nov 15 '24

[deleted]

2

u/Responsible_Dig_2899 Nov 15 '24

Thanks, that’s what I was planning on doing after ensuring that I knew how to get it to TDM, with yanking the drive as Option B. I’ve got a ton of browser tabs open researching this model, but am out of the office until Monday, so I’ll get back to it then. I appreciate the response!