<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
		xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd"
	xmlns:media="http://search.yahoo.com/mrss/"
>

<channel>
	<title>Forensic 4cast &#187; macbook</title>
	<atom:link href="http://www.forensic4cast.com/tag/macbook/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.forensic4cast.com</link>
	<description>Welcome to our podcast discussing issues relating to digital forensics</description>
	<lastBuildDate>Tue, 10 Jan 2012 15:28:10 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<copyright>Copyright © Forensic 4cast 2011 </copyright>
	<managingEditor>lee@whitfields.org (Lee Whitfield)</managingEditor>
	<webMaster>lee@whitfields.org (Lee Whitfield)</webMaster>
	<category>Tech News</category>
	<ttl>1440</ttl>
	<image>
		<url>http://www.forensic4cast.com/4small.jpg</url>
		<title>Forensic 4cast</title>
		<link>http://www.forensic4cast.com</link>
		<width>144</width>
		<height>144</height>
	</image>
	<itunes:new-feed-url>http://www.forensic4cast.com/?feed=podcast</itunes:new-feed-url>
	<itunes:subtitle>Forensic 4cast</itunes:subtitle>
	<itunes:summary>Welcome to the wonderful world of digital and computer forensics.  In each episode Lee will have guests on the show to discuss the latest news in the field, tell stories from the real world, and much more.</itunes:summary>
	<itunes:keywords>digital, computer, forensics, forensic, legal, law, cyber, crime</itunes:keywords>
	<itunes:category text="Technology">
		<itunes:category text="Tech News" />
	</itunes:category>
	<itunes:author>Lee Whitfield</itunes:author>
	<itunes:owner>
		<itunes:name>Lee Whitfield</itunes:name>
		<itunes:email>lee@whitfields.org</itunes:email>
	</itunes:owner>
	<itunes:block>no</itunes:block>
	<itunes:explicit>no</itunes:explicit>
	<itunes:image href="http://www.forensic4cast.com/4.jpg" />
		<item>
		<title>MacBook Air Acquisition</title>
		<link>http://www.forensic4cast.com/2009/03/macbook-air-acquisition/</link>
		<comments>http://www.forensic4cast.com/2009/03/macbook-air-acquisition/#comments</comments>
		<pubDate>Sun, 15 Mar 2009 08:24:30 +0000</pubDate>
		<dc:creator>Lee Whitfield</dc:creator>
				<category><![CDATA[Technical Articles]]></category>
		<category><![CDATA[acquire]]></category>
		<category><![CDATA[acquisition]]></category>
		<category><![CDATA[air]]></category>
		<category><![CDATA[copy]]></category>
		<category><![CDATA[forensic]]></category>
		<category><![CDATA[macbook]]></category>
		<category><![CDATA[pictorial]]></category>
		<category><![CDATA[tableau]]></category>
		<category><![CDATA[zif]]></category>

		<guid isPermaLink="false">http://4cast.whitfields.org/?p=135</guid>
		<description><![CDATA[Lee provides show how to extract the drive ready from a MacBook Air.]]></description>
			<content:encoded><![CDATA[<p>The MacBook Air presents a unique problem that is not found with other Apple products.  With other Apple computers the ‘Macquisition’ tool can be used to create an image of the drive in question if the drive is not easily accessible.  Unfortunately Macquisition requires a free firewire (IEEE 1394) port in order to boot the computer into acquisition mode.  The MacBook Air has only one USB port, no firewire port, and no optical drive.  The Apple website suggests that only an Apple branded USB optical drive will allow booting from optical media (such as Helix).  These drives can be costly and largely pointless to purchase.<br />
This guide provides a (relatively) simple method of removing the internal drive and imaging the drive using EnCase (or whatever brand of imaging tool you use).<br />
Firstly, meet the MacBook Air:</p>
<p><img class="aligncenter size-full wp-image-157" title="air11" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air11.jpg" alt="air11" /></p>
<p>The first thing you will notice is that this is a very thin computer; it has an aluminium (aluminum for you non-Brits) case.  This is quite slippery so take care not to drop it.<br />
The first thing you will need to do is turn it over.<br />
There are ten screws that need removing (circled below).  The front six screw are the same size; the rear-corner screws are a little longer; the middle-rear screws are longer still.  Keep track of these for putting it back together.</p>
<p><img class="aligncenter size-full wp-image-161" title="air2" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air2.jpg" alt="air2" /></p>
<p>Once the bottom of the case is off you are going to focus your attention on the rear-right corner of the computer (highlighted below).</p>
<p><img class="aligncenter size-full wp-image-162" title="air3" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air3.jpg" alt="air3" /></p>
<p>When you look closer at this corner you can see two ribbon cables.  The first of these is disconnected at ‘A’ by pulling on tab ‘B’ below:</p>
<p><img class="aligncenter size-full wp-image-165" title="air4" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air4.jpg" alt="air4" /></p>
<p>Once this has been completed you will see four more screws (circle below).  The top two screws are easily enough removed, the bottom two screws are partially obscured by a thin wire.  The wire is tucked in the drive cage.  Gently pry the cable away until the screws are exposed and remove the screws.</p>
<p><img class="aligncenter size-full wp-image-166" title="air5" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air5.jpg" alt="air5" /></p>
<p>We are now ready to remove the second ribbon cable.  Gently pull it away (marked in red below) until it is no longer connected.</p>
<p><img class="aligncenter size-full wp-image-167" title="air6" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air6.jpg" alt="air6" /></p>
<p>Removing the drive is not difficult, carefully life the drive cage and slide the hard drive out from underneath.  Do not pull it out from the top or try to remove the drive cage as you may cause irreparable damage.</p>
<p><img class="aligncenter size-full wp-image-168" title="air7" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air7.jpg" alt="air7" /></p>
<p>Once you have removed the drive the drive turn it over and carefully remove the black tape covering the ribbon connection (marked below).</p>
<p><img class="aligncenter size-full wp-image-173" title="75" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/75.jpg" alt="75" /></p>
<p>Once the tape has been removed the ribbon connection is exposed.  Carefully pull the ribbon cable out of the connector (marked below).</p>
<p><img class="aligncenter size-full wp-image-169" title="air8" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air8.jpg" alt="air8" /></p>
<p>When finished you should have something the looks like the picture below:</p>
<p><img class="aligncenter size-full wp-image-170" title="air9" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air9.jpg" alt="air9" /></p>
<p>This is a ‘ZIF’ drive.  These drives are commonly found in iPods and ultraportable PCs.  In order to image this drive you will require the following:</p>
<ul>
<li>Either a ‘Tableau T14 IDE’ or a ‘Tableau T35e’ write blocking device</li>
<li>A ‘TDA5-ZIF’ drive adapter kit</li>
</ul>
<p>Why so specific? Well, Tableau state that the ‘ZIF’ adapter is only guaranteed to work with one of the two Tableaux mentioned above.  I do not want to risk something going wrong so I’ll follow their advice.  Thankfully I had a ‘T35e’ already available.  You can try using this adapter with a different model, or even a different brand of write-blocker, but its not recommended.<br />
Carefully insert the new ribbon (provided with the adapter) into the ribbon connector on the hard drive and then connect the other end of the ribbon into the adapter (see below).  Then plug the adapter into the Tableau.</p>
<p><img class="aligncenter size-full wp-image-171" title="air10" src="http://www.forensic4cast.com/wp-content/uploads/2009/03/air10.jpg" alt="air10" /></p>
<p>From this point forward it is exactly the same as acquiring any other hard drive.  The Tableau will pick up the drive allowing you to image as normal.</p>
<p>Hope this is useful to someone out there.</p>
<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.forensic4cast.com%2F2009%2F03%2Fmacbook-air-acquisition%2F&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.forensic4cast.com/2009/03/macbook-air-acquisition/"></g:plusone>
			</div>
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.forensic4cast.com/2009/03/macbook-air-acquisition/"  data-text="MacBook Air Acquisition" data-count="horizontal" data-via="4cast">Tweet</a>
			</div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div>]]></content:encoded>
			<wfw:commentRss>http://www.forensic4cast.com/2009/03/macbook-air-acquisition/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
	</channel>
</rss>

