Application Note

Using Apple’s Target Disk Mode with the Forensic Falcon™ to access a Mac’s internal drive as a Source drive (For use with or FireWire)

Introduction: This document provides instructions on how to access a Mac’s internal drive to be used as a Source drive on the Forensic Falcon using either the Mac’s on-board Thunderbolt or FireWire port. This method will allow the Falcon to see the Mac’s internal drive as a Source drive. The drive can then be imaged or hashed using the Falcon.

Sections: I – Requirements II – Connecting the Mac to the Falcon III – Enabling Target Disk Mode on the Mac IV – What to Expect on the Falcon

Section I – Requirements: A Mac with: o At least one native Thunderbolt/Thunderbolt 2 or FireWire port o Target Disk Mode support (If you are unsure whether the Mac supports Target Disk Mode, please contact Apple). For Macs with Thunderbolt/Thunderbolt 2 – Apple’s Thunderbolt to FireWire adapter and a FireWire 800 to 800 cable (one is included with the Falcon) For Macs with FireWire 800 – A FireWire 800 to 800 cable (one is included with the Falcon) For Macs with FireWire 400 – A FireWire 400 to 800 adapter with a FireWire 800 to 800 cable (one FireWire 800 to 800 cable is included with the Falcon) or a FireWire 400 to 800 cable.

Section II – Connecting the Mac to the Falcon: Using a Thunderbolt port: 1. Connect the Apple Thunderbolt to FireWire adapter to the Mac’s Thunderbolt port. 2. Connect one end of the FireWire 800 to 800 cable to the Thunderbolt to FireWire adapter. 3. Connect the other end of the FireWire 800 to 800 cable to the Falcon’s FireWire Source port (FW_S1) on the left side of the Falcon.

Page 1 of 2 APPNOTE-Mac_Internal_Drive_as_Source_to_Falcon-v1.0

Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com Application Note

Using a FireWire 800 port: 1. Connect one end of the FireWire 800 to 800 cable to to the Mac’s FireWire 800 port. 2. Connect the other end of the FireWire 800 to 800 cable to the Falcon’s FireWire Source port (FW_S1) on the left side of the Falcon.

Using a FireWire 400 port: If a FireWire 400 to 800 adapter is available: a. Connect the 400 adapter to the Mac’s FireWire 400 port. b. Connect one end of the FireWire 800 to 800 cable to to the Mac’s FireWire 800 port. c. Connect the other end of the FireWire 800 to 800 cable to the Falcon’s FireWire Source port (FW_S1) on the left side of the Falcon. If a FireWire 400 to 800 cable is available: a. Connect the FireWire 400 to 800 cable to the Mac’s FireWire 400 port. b. Connect the other end of the FireWire 400 to 800 cable to the Falcon’s FireWire Source port (FW_S1) on the left side of the Falcon.

III – Enabling Target Disk Mode on the Mac Once the Mac is connected to the Falcon, the Mac has to be booted up into Target Disk Mode (TDM). TDM is a boot mode unique to Macs which bypasses the and enables its drives to behave as Thunderbolt or FireWire external mass storage device. To enable Target Disk mode: 1. make sure the Mac is connected to the Falcon (See Section II) and turned off. 2. Turn on the Mac and immediately press and hold the T key on the keyboard. 3. Keep holding the T key until a FireWire or Thunderbolt icon. When the FireWire or Thunderbolt icon appears, release the T key. The Mac should now be in Target Disk Mode. Proceed to Section IV – What to Expect on the Falcon. Notes: For portable Macs (e.g. MacBook, MacBook Pro), it is highly recommended that the power supply be connected to provide continuous power to the device. If the Mac is not into TDM, please contact Apple for support for Target Disk Mode.

IV – What to Expect on The Falcon The Falcon will treat the internal drive on the Mac as any drive connected to the Source position (write- protected). The internal drive on the Mac, like any other drive connected to a Source port on the Falcon, should now appear on the following tasks: Imaging (Source) Hash USB Device

Page 2 of 2 APPNOTE-Mac_Internal_Drive_as_Source_to_Falcon-v1.0

Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com