Once you have created the forensic disk image, you now have the ability to analyse it using software such as Forensic Toolkit (FTK) or BitCurator.
After installing the drivers and re-mounting the disk image I had no problem browsing through the files and folders. This meant that Windows could not read it, and asked if I wanted to format the disk when trying to access it through the Windows file browser. I tried mounting the disk image through FTK Imager before I had installed the HFS+ drivers. The disk imaging process was roughly four hours, and due to the fact that I only had a couple of 256 solid state drives on the PC, I needed to split the output of files across the drives by adding an overflow image destination. You can set it to create one single file, but with restrictions on file sizes on various file systems it is best to break it down into smaller chunks. With a 500GB hard drive on the Mac, I left the default image fragment size of 1.5GB which divides the image into a series of sequentially numbered files all 1.5 GB in size. Once I had everything connected, and the MacBook booted in TDM, I used FTK Imager to create a physical disk image. It is important to have these things in mind when laptops are acquired as part of a collection. If the disk is encrypted and you have the login details you can turn FileVault off, otherwise you will need to look into decryption. It is also critical that FileVault is not turned on, otherwise the filesystem will be encrypted. Use a USB flash drive or other secondary volume to create a bootable installer.You need a Mac computer with the ability to boot in TDM.
Use the App Store to download and install the latest macOS or an earlier macOS.You can also use these methods to install macOS, if the macOS is compatible with your Mac: If you just erased your entire startup disk, you might be offered only the macOS that came with your Mac, or the closest version still available.If the Mac logic board was just replaced, you might be offered only the latest macOS that is compatible with your Mac.Or you can use Option-Command-R during startup to be offered either the latest macOS that is compatible with your Mac, or in some cases the macOS that came with your Mac or the closest version still available. On an Intel-based Mac, you can use Shift-Option-Command-R during startup to be offered the macOS that came with your Mac, or the closest version still available.When you install macOS from Recovery, you get the current version of the most recently installed macOS, with some exceptions: When the new owner starts up the Mac, they can use their own information to complete setup. If you're selling, trading in, or giving away your Mac, press Command-Q to quit the assistant without completing setup. Your Mac might restart and show a progress bar several times, and the screen might be empty for minutes at a time.Īfter installation is complete, your Mac might restart to a setup assistant. Allow installation to complete without putting your Mac to sleep or closing its lid.If the installer offers you the choice between installing on Macintosh HD or Macintosh HD - Data, choose Macintosh HD.If the installer doesn't see your disk, or it says that it can't install on your computer or volume, you might need to erase your disk first.
To begin installation, select Reinstall macOS from the utilities window in macOS Recovery, then click Continue and follow the onscreen instructions.įollow these guidelines during installation: Reinstalling macOS does not remove data from your Mac.