Booting an Apple Macintosh in target disk mode allows computer forensic examiners to copy relevant files from the internal drive on a Mac computer. Removing hard drives instead from a Mac computer can be time-consuming and damage the system when not performed properly. Therefore, target disk mode allows forensic examiners to access the internal Mac drive as an external hard drive from another Mac or a Windows PC.
Target disk mode requires the host computer (systems accessing the Mac) to connect via a FireWire port (or Thunderbolt with newer Macs) to the target Mac. You must purchase an adapter if there is no FireWire port on the Windows host computer. Many laptops have PCMCIA or ExpressCard/34 slots that allow the insertion of a FireWire card. Make sure the cable fits the FireWire connector on the Mac since there are different shape connectors for FireWire standards.
WINDOWS HOST COMPUTER SETUP
When using a Windows PC to access the target Mac hard drive, there are a few things to prepare:
- Make sure you have a FireWire port and the appropriate cable. You can purchase FireWire ExpressCard/34 adapters for laptops with an ExpressCard slot.
- Software installed on the host computer that can recognize a Mac (HFS, HFS+ etc.) file system. MacDrive from Mediafour (www.mediafour.com/products/macdrive/) is a well-known, and useful tool for accessing Mac drives in target mode or Mac formatted hard drives you receive.
- CrossCopy and Harvester from Pinpoint Labs (www.pinpointlabs.com) are popular applications that can copy and even keyword filter the files on a Mac drive once connected and mounted on the host computer.
USING FIREWIRE TARGET DISK MODE
Once your host Windows computer is set up and ready to access the target Mac, follow these steps:
- Make sure the target Mac computer is turned off.
- Connect the FireWire cable from the Windows host to the target Mac.
- Turn on the target Mac while holding the “T” key until you see the FireWire icon. The target computer’s hard drive should become available on the host computer, and you will then be able to access the files from the Mac hard drive.
- Use a defensible copy utility or hard drive imaging application to collect the relevant contents.
- You may turn off the target Mac computer when the copy is completed and disconnect the FireWire cable.
USING THUNDERBOLT TARGET DISK MODE
Newer Apple Macintosh computers with Thunderbolt ports (faster than FireWire) will also display the Thunderbolt icon when going into target mode. If the target Mac only displays the FireWire icon, as shown above, you will need to use the FireWire port to access the Mac internal drive from the host computer.
MACBOOK THUNDERBOLT PORT
Thunderbolt ports for Windows PCs are available. However, at this time, Pinpoint Labs has not yet tested access to a Mac in target mode using a Windows PC via a Thunderbolt connection. We will provide a follow-up note at a later date once we have had a chance to determine its effectiveness during a computer forensic collection physically.
Pinpoint Labs’ CrossCopy is a much easier solution than running a Mac in target disk mode if you can make logical file copies from a live (booted) system. CrossCopy runs natively on macOS systems and can run from an external drive where no software needs to be installed. CrossCopy provides 100% file verification, preserves file timestamps and metadata like other Pinpoint products, and creates a chain of custody verification logs.
Apple Macintosh computers continue to increase in popularity. Corporate IT managers, litigation support professionals, and computer forensic examiners are often tasked with preserving data from Mac hard drives. Booting a Mac in target disk mode is one way to gain access to relevant files without disassembling the system, which in most circumstances would void the warranty and/or damage the system. Harvester and CrossCopy from Pinpoint Labs (www.pinpointlabs.com) are great utilities for fast and safe copying of files from Mac and Windows PC’s.