DOCSLIB.ORG

15 596802 Bindex.Qxd

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
15 596802 Bindex.Qxd Index AirTunes, 123 SYMBOLS alarms, 166 , (comma), dial-up pause character, 111 Allume Systems, 211 Alsoft DiskWarrior, 235, 239–240 A always-on connections, 117–118 AC adapter, 2, 238 amber light, 2 accessories, travel, 69–70 animating opening applications, 34 accounting applications, 199 Anonymizer.com, 216 accounts. See also user accounts AOL, 106 administrative, security, 78 AOL Instant Messaging (AIM), 202 Administrator, 46 appearance settings, 38–39 Managed, 46 Apple File Protocol (AFP), 146 managing, 41–46 Apple menu, 10–11 Standard, 46 Apple Video Out, 54 test, for troubleshooting, 247 AppleScripts, launching from iCal, 166 types of, 46 AppleShare, passwords, 86 Acme Made, 70 application server provider (ASP), 197–200 Address Book applications contact cards. See vCards cycling through, 26 printing launching from the Dock, 32 envelopes, 175–176 managing from the Dock, 33 mailing labels, 175–176 switching, 35 pocket address books, 175, 177 troubleshooting, 245–247 vCards, 175, 177 Applications (Mac OS 9) and System folder, 12 synchronizing Applications folder, 11 automatically, 178 appointments. See calendars; events; iCal Bluetooth devices, 180–181 ASP (application server provider), 197–200 configuring, 181–182 attendees, specifying, 167 with iPods, 182–184 audio conferencing, 202–207 iSync, 178–182 audio ports, 8 .Mac, 175, 178 automatic password generation, 77–78 manually, 178 Automator, 101–102 Missing Sync for PocketPC, 179 AV cables and adapters, troubleshooting, 241 mobile phones, 178–181 PDAs, 178–181 Pocket Mac, 179 B backing up files on a schedule, 178 Automator, 101–102 vCards Carbon Copy Cloner, 245 default format, 173 cloning, 245 deleting, 174 Dantz Retrospective, 100 description, 172–173 COPYRIGHTEDdescription, MATERIAL 93 groups, 174–175 to disk image, 101–102 notes, 174 Dobry Backuper, 101 printing, 175, 177 to drive or disc, 96–99 searching, 174 gathering modified files, 101–102 Smart Groups, 175 Intego Personal Backup X, 100 administrative accounts, security, 78 to an iPod, 184–186 Administrator accounts, 46. See also accounts with .Mac, 94–96 administrator System Preferences, 36–37 programs for, 100–102 AFP (Apple File Protocol), 146 restoring from backup, 99–100 AIM (AOL Instant Messaging), 202 scheduling backups, 95–96, 99 air circulation, 4 SuperDuper, 245 AirPort Base station, 121–124 synchronization backup, 95 AirPort card, 258–259, 262 Synchronize X, 100 AirPort Express, 123 266 Index ✦ B—E BackPack, 199 clock, System Preferences, 41 backup media, maintenance, 238–239 clock widget, 30–31 Backup program, 94–96 cloning, 245 base stations, 134, 144–146 coloring calendars, 167 BaseCamp, 199 comma (,), dial-up pause character, 111 batteries. See also power management Compact Flash cards, 209 calibrating, 2 compression, enabling, 113 charging indicator, 2 configuring your laptop. See System Preferences FireWire devices, 185 contacts. See Address Book life expectancy, 240–241 cooling accessories, 4 power cables, 240–241 critical files, troubleshooting, 241–242 settings, 71–72 customer relations applications, 199 spare, 238 customizing your laptop. See System Preferences status, 72, 73–74 troubleshooting, 240–241, 249–251 D USB devices, 185 daisy chaining peripherals, 6 Battery Status icon, 73–74 Dantz Retrospective, 100 Belkin, 70 Dashboard, 28–31 Bluetooth devices, 51–52, 180–181 database applications, 199 BOM (bill of materials), 234 date and time settings, 40–41 Bonjour, 149, 204, 206 DC connector, 2 Bookendz, 52 defragmenting hard drives, 236 boot disk, 238 Deja Time Out, 56 broadband. See high-speed connections Desktop, 24–28 browsing by proxy, 216 Desktop folder, 12 burning optical discs, 209–210 devices. See specific devices button appearance, 39 DHCP server, 136–139 dial tone, waiting for, 113 C dial-up. See modem connections cables digital photography, 208–209 AV, troubleshooting, 241 Digital Video Interface (DVI), 54 Category 5. See Ethernet, patch cables directories, maintenance, 234–236 Ethernet patch, 134, 237, 241 disconnecting users, 108–109 extras, for traveling, 189–190 Disk Defrag, 236 FireWire, 238, 241 disk defragmentation, 236 maintenance, 237–238 disk images, 92–93, 101–102, 210–213 patch. See Ethernet, patch cables Disk Utility, 234–236, 239 phone, troubleshooting, 240 displays, 53–56, 70 power, and batteries, 240–241 distribution lists. See groups security, 70 DNS servers, 141 troubleshooting, 240–241 Dobry Backuper, 101 USB, 238, 240 dock (hardware), 52 calendars. See also iCal Dock (software), 10–11, 32–35 coloring, 167 Documents folder, 12 naming, 167 domain names, 133 printing, 171–172 double-click speed, 18 publishing, 167–169 Dr Bott LLC, 70 searching, 170 drag lock, 19 subscribing to, 169–170 dragging option, 18 synchronizing to an iPod, 183–184 DVD. See optical discs calibrating the battery, 2 DVI (Digital Video Interface), 54 call waiting, 111, 114 Carbon Copy Cloner, 245 E carrying your laptop. See traveling eFax, 196 cases, 67–69 e-mail, 186–190, 207, 216–218. See also Address Book Category 5 cables. See Ethernet, patch cables emergency boot disk, 238 CD. See optical discs encryption, 76, 89–93, 216–218 certificates, 218 End key, 20 clean Desktop, 26 Energy Saver pane, 71–74 cleaning ports, 8 energy saving tips, 72–73 cleaning your laptop, 69–70 envelopes, printing, 175–176 clicking option, 18 ergonomics, 50–56 Index ✦ E—K 267 error correction, enabling, 113 hot corners, 27–28 Ethernet hotspots, 118–119, 188 networking, 134–139 hubs, 133–134, 144–146, 150 patch cables, 134, 237, 241 ports, 6 I events, 166–167, 170 iBook (original), upgrading, 254–256 Exposé, 24–28 iBook G4, upgrading, 256–257 external display ports, 8 iCal. See also calendars alarms, 166 F events, 166–167, 170 Fast User Switching, 14, 47–48 initial window, 164 faxing, 193–197 launching AppleScripts, 166 files mini-month, hiding/showing, 165 critical, troubleshooting, 241–242 opening files, 166 exchanging, with an iPod, 184–186 prioritizing events, 165 modified, gathering, 101–102 specifying attendees, 167 opening with iCal, 166 time zone, choosing, 170 problems, troubleshooting, 247–249 to-do lists, 165–166 sending with iChat, 149 iceBook, upgrading, 256–257 sharing, 144–149, 215–216 iceStation stand, 53 FileVault, 90–91 iChat, 148–149, 218–219 Finder, 9–10 iChat AV, 202–207 FindNot.com, 216 iCover keyboard cover, 70 firewalls, 155–162 iCurve stand, 53 FireWire cables, 238, 241 iDefrag, 236 FireWire devices, 8–9, 185 iDisk, 63–67 FireWire ports, 6, 8 IEEE 802.11g. See wireless connections first aid kit, maintenance, 237–239 IEEE-1394 ports, 6 First Aid tab, 234–236 iLap stand, 4, 53 first-time use. See setting up your laptop iLink ports, 6 flash drives, 208 input peripherals, 50–52 Fn keys, 19–22 instant messaging, 202 folders, 11–14 Intego Personal Backup X, 100 FolderSynchronizer, 60–61 interface elements. See user interface font smoothing, 39 Internet function keys, 19–22 connections, sharing, 144–146 network access, 150–153 G startup connection information, 3 gestures, 18 Web accelerators, 106 GraphicConverter, 248 Web authoring, 207 green light, 2 Web hosting, 207 Griffin Technology, 232 Web-based applications, 197–200 groups, 174–175 Webmail applications, 188–189 IOGEAR, 70 IP addresses, 133, 135–141 H iPods, synchronizing with Address Book, 182–184 hard drives ISPs (Internet service providers), 106 backing up to, 96–99 iSync, 178–182 defragmenting, 236 flash drives, 208 key drives, 208 K optimizing, 236 key drives, 208 organization, 11–14 keyboards pen drives, 208 alternate characters. See function keys remote disk storage, 207 cleaning cloths, 70 headphone ports, 8 covers, 70 heat management, 4–5, 252 End key, 20 highlight color, 39 external, 51 high-speed connections, 114–118, 126–127 function keys, 19–22 hints, password, 80, 87 Home key, 20 Home folder, 89–91, 211–213 shortcuts, 22–23 Home key, 20 wireless, 51–52 keychains, 83–88 268 Index ✦ L—P multihoming, 153–154 L port priority, 153–154 Library folder, 11, 13 routers, 134, 150, 152 lights security, 155–162 amber, 2 services, enabling/disabling, 156–158 battery charge indicators, 2 sharing green, 2 files, 144–146, 146–149 sleep indicator, 5 Internet connections, 144–146 locations, 128–130 printers, 149–150 logging in, 14, 80 Stealth Mode, 162 logging out, 14, 47–48 subnet masks, 133 logon options, security, 79–80 switches, 133–134, 150 logout for inactivity, 81 switching connection types. See multihoming types of connections, 133–134 M UDP (User Datagram Protocol), 160–162 .Mac account Windows-based PCs, 146, 220–224 backing up files, 94–96 wireless, AirPort cards, 141–144 on the road, 188, 207 Norton Antivirus, 240 sync tools, 61–67 notes, in vCards, 174 synchronizing with Address Book, 175, 178 Macally, 53, 70, 232 O magnification, 34 on the road. See traveling mailing labels, printing, 175–176 online on the road maintenance, 234–239. See also troubleshooting AOL, 106 Managed accounts, 46. See also accounts high-speed access, 114–118 manual dialing, 112 mobile phone connections, 125–128 MarkSpace, 179 modem connection, 106–114 media readers, 208–209 network locations, 128–130 menu appearance, 39 Web accelerators, 106 Menu bar, 10 wireless connections, 118–125 MetroPipe.com, 216 Worldwide Phone Guide, 114 Micromat TechTool Pro, 235 Open Firmware passwords, 82–83 miniaturizing windows, 24–25 operating temperature, 252 Mini-DVI, 54 optical discs, 96–99, 209–210 minimization effects, 34 optical drives, cleaning, 236–237 mini-month, hiding/showing, 165 optimizing disks, 236 Mini-VGA, 54 overseas travel kit, 70 Missing Sync for PocketPC, 179 mobile phones,
Load more

Recommended publications
  • Application Note
    Application Note Using Apple’s Target Disk Mode to access a Mac’s internal drive as a Source drive (For use with Thunderbolt or FireWire) with the Forensic Falcon™ or Talon® Ultimate Introduction: This document provides instructions on how to access a Mac’s internal drive to be used as a Source drive on the Forensic Falcon or Talon Ultimate using either the Mac’s on-board Thunderbolt or FireWire port. This method will allow the Falcon or Talon Ultimate to see the Mac’s internal drive as a Source drive. The drive can then be imaged or hashed using the Falcon or Talon Ultimate. The Talon Ultimate FireWire ports can be enabled with purchase of the FireWire option. The Falcon FireWire ports are already enabled and do not require any option purchased. Sections: I – Requirements II – Enabling Target Disk Mode on the Mac III – What to Expect on the Falcon/Talon Ultimate Section I – Requirements: A Forensic Falcon or Talon Ultimate (the Talon Ultimate must have the FireWire option purchased and enabled. A Mac with: o At least one native Thunderbolt/Thunderbolt 2 or FireWire port o Target Disk Mode support (If you are unsure whether the Mac supports Target Disk Mode, please contact Apple). For Macs with Thunderbolt/Thunderbolt 2 – Apple’s Thunderbolt to FireWire adapter and a FireWire 800 to 800 cable (one is included with the Falcon) . For Macs with FireWire 800 – A FireWire 800 to 800 cable (one is included with the Falcon, but not with the Talon Ultimate) . For Macs with FireWire 400 – A FireWire 400 to 800 adapter with a FireWire 800 to 800 cable (one FireWire 800 to 800 cable is included with the Falcon but not with the Talon Ultimate) or a FireWire 400 to 800 cable.
    [Show full text]
  • Power Mac G4 (Digital Audio): Setting up (Manual)
    Setting Up Your Power Mac G4 Includes setup and expansion information for Power Mac G4 and Macintosh Server G4 computers K Apple Computer, Inc. © 2001 Apple Computer, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Every effort has been made to ensure that the information in this manual is accurate. Apple is not responsible for printing or clerical errors. Apple Computer, Inc. 1 Infinite Loop Cupertino, CA 95014-2084 408-996-1010 http://www.apple.com Apple, the Apple logo, AppleShare, AppleTalk, FireWire, the FireWire logo, Mac, Macintosh, the Mac logo, PlainTalk, Power Macintosh, QuickTime, and Sherlock are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, the Apple Store, Finder, iMovie, and Power Mac are trademarks of Apple Computer, Inc. PowerPC and the PowerPC logo are trademarks of International Business Machines Corporation, used under license therefrom. Manufactured under license from Dolby Laboratories. “Dolby” and the double-D symbol are trademarks of Dolby Laboratories. Confidential Unpublished Works. © 1992–1997 Dolby Laboratories, Inc. All rights reserved. Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation.
    [Show full text]
  • Setting up Your Power Mac G4 Includes Setup and Expansion Information for Power Mac G4 Abs Macintosh Server G4 Computers
    Setting Up Your Power Mac G4 Includes setup and expansion information for Power Mac G4 abs Macintosh Server G4 computers Setting Up Your Power Mac G4 Includes setup and expansion information for Power Mac G4 abs Macintosh Server G4 computers Apple Computer, Inc. © 2000 Apple Computer, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the "keyboard" Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Every effort has been made to ensure that the information in this manual is accurate. Apple is not responsible for printing or clerical errors. Apple Computer, Inc. 1 Infinite Loop Cupenino, CA 95014-2084 408-996-1010 http://www.apple.com Apple, the Apple logo, AppleShare, AppleTalk, FireWire, the FireWire logo, Mac, Macintosh, the Mac logo, PlainTalk, Power Macintosh, and QuickTime are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, the Apple Store, Finder, iMovie, iTools, Power Mac, and Sherlock are trademarks of Apple Computer, Inc. PowerPC and the PowerPC logo are trademarks of International Business Machines Corporation, used under license therefrom. Manufactured under license from Dolby Laboratories. "Dolby" and the double-D symbol are trademarks of Dolby Laboratories, Confidential Unpublished Works. © 1992-1997 Dolby Laboratories, Inc. All rights reserved. Other company and product names mentioned herein are trademarks of their respective companies.
    [Show full text]
  • About the Power Mac G4 Cube (Manual)
    About the Power Mac G4 Cube Includes setup and expansion information for Power Mac G4 Cube computers K Apple Computer, Inc. © 2000 Apple Computer, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Every effort has been made to ensure that the information in this manual is accurate. Apple is not responsible for printing or clerical errors. Apple Computer, Inc. 1 Infinite Loop Cupertino, CA 95014-2084 408-996-1010 http://www.apple.com Apple, the Apple logo, AppleShare, AppleTalk, FireWire, the FireWire logo, Mac, Macintosh, the Mac logo, Power Macintosh, and QuickTime are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, the Apple Store, Finder, iMovie, iTools, Power Mac, and Sherlock are trademarks of Apple Computer, Inc. PowerPC and the Power PC logo are trademarks of International Business Machines Corporation, used under license therefrom. Manufactured under license from Dolby Laboratories. “Dolby” and the double-D symbol are trademarks of Dolby Laboratories. Confidential Unpublished Works. © 1992–1997 Dolby Laboratories, Inc. All rights reserved. Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation.
    [Show full text]
  • RECON-IMAGER-Manual.Pdf
    RECON IMAGER Manual 1.Introduction Version 4.0.5 RECON IMAGER was developed by SUMURI to provide the digital forensic practitioner with a bootable imaging utility that supports all modern Macintosh computers with Intel processors. This is accomplished via three macOS based boot environments that have been modified to ensure that there are no writes to internal or externally attached media. Additionally, RECON IMAGER helps the practitioner to easily identify Apple File System (APFS) container disks and volumes, FileVault, Fusion and other Core Storage volumes. RECON IMAGER has been designed to get as much data as possible to include the Apple Extended Attributes and Local Time Machine Snapshots (APFS Snapshots). In addition to creating forensic images of physical disks and/or volumes, RECON IMAGER can also image Mac RAM without the need for an administrator password within RECON IMAGER’s boot environment. RECON IMAGER also supports imaging Macs with T2 Security Chipsets via Target Disk Mode or disabling Secure Boot via the Mac’s Recovery Mode. Copyright © 2010-2020 SUMURI LLC. All rights reserved. ​1 RECON IMAGER Manual 2. Version Comparisons There are two versions of RECON IMAGER – Standard and PRO. RECON IMAGER (standard) RECON IMAGER (standard) is based on macOS. Since it is based on macOS it natively boots Intel Macs. It also supports Apple proprietary technology such as Apple File System (APFS) container disks and volumes, FileVault, Fusion and other Core Storage volumes. RECON IMAGER includes the option to image logically which allows an examiner to import Apple data into forensic tools that do not natively support proprietary Apple file systems.
    [Show full text]
  • Xserve G5 User's Guide (Manual)
    Xserve G5 User’s Guide Includes setup, expansion, and hardware specifications for Xserve G5 K Apple Computer, Inc. © 2004 Apple Computer, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of Apple. Your rights to the software are governed by the accompanying software license agreement. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Every effort has been made to ensure that the information in this manual is accurate. Apple is not responsible for printing or clerical errors. Apple 1 Infinite Loop Cupertino, CA 95014-2084 408-996-1010 www.apple.com Apple, the Apple logo, FireWire, the FireWire logo, iBook, Mac, Macintosh, Mac OS, PowerBook, QuickTime, and Xserve are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. PowerPC and the PowerPC logo are trademarks of International Business Machines Corporation, used under license therefrom. This product includes software developed by the University of California, Berkeley, and its contributors. Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the performance or use of these products. Simultaneously published in the United States and Canada.
    [Show full text]
  • Target Disk Mode
    1-to-1 with 1 Man Bob Gendler Apple Platform Engineer/1-to-1 Coordinator St. Andrew’s Episcopal School Designing a 1-to-1 Program • End dependency on laptop carts • Allow everyone to exist on the same platform • Fit our school culture What is our 1-to-1 Program? 13” Apple MacBook Air • 3 Year Rotation to match AppleCare • Case & Sleeve provided • Microsoft Office 365, Adobe CC Suite, other software licenses • CrashPlan ProE, OpenDNS Filtering, Dyknow • Google Apps for Education w/Backupify Why this VS other Models • 1-to-1 Provided by the School • 1-to-1 Purchased by the Family, sudo-BYOD • BYOD What things to consider? • Power • ISP Bandwidth • Backbone Systems • Wireless System • Damage and Repairs • Parental Concerns and Communications Where do we begin? Manual Labor “Don’t underestimate the time this process takes!” • Unboxing • Labeling • Shelling • Sleeving How do we image? “Multiply this by hundreds and you are talking hours of difference!” Full Image vs Thin Image • Full - 4.5 minutes, roughly • Thin - 3 minutes, roughly The Imaging Shelf Imagine: Year One 30-45 min Netbooting over USB to Ethernet Adapter • USB Ethernet is painfully slow! • Full OS with Microsoft Office and Adobe Photoshop baked into image • Lots of PKGs and DMGs to install • Mix Monolithic/Modular Imaging: Year Two 20-30 min Netbooting over Thunderbolt Adapters • Faster Pipes but same basic install • Full OS with Microsoft Office 2011 & Adobe Photoshop baked into the image • Lots of PKGs and DMGs to install • Mix Monolithic/Modular Imaging: Year Three & Four 8-11 min
    [Show full text]
  • Imaging Mac Computers with Jamf Pro
    Imaging Mac Computers with Jamf Pro Technical Paper 3 August 2018 © copyright 2002-2018 Jamf. All rights reserved. Jamf has made all efforts to ensure that this guide is accurate. Jamf 100 Washington Ave S Suite 1100 Minneapolis, MN 55401-2155 (612) 605-6625 Apple, the Apple logo, FireWire, iMac, Mac, MacBook, MacBook Air, MacBook Pro, macOS, and OS X are trademarks of Apple Inc., registered in the U.S. and other countries. The CASPER SUITE, Jamf, the Jamf Logo, JAMF SOFTWARE®, and the JAMF SOFTWARE Logo® are registered or common law trademarks of JAMF SOFTWARE, LLC in the U.S. and other countries. All other product and service names mentioned herein are either registered trademarks or trademarks of their respective companies. Contents Contents 4 Introduction 4 Target Audience 4 What's in This Guide 5 Target Mode Imaging 5 Requirements 6 Before You Begin 8 Imaging Computers 9 Post-imaging Enrollment 9 Troubleshooting 11 NetBoot Images 11 Requirements 12 Step 1: Determine Which NetBoot Images to Create 12 Step 2: Create Clean Base OS Images 13 Step 3: Create the NetBoot Images 13 Step 4: Upload the NetBoot Images 14 Step 5: (Optional) Create Configurations 15 Step 6: Boot the Target Computers to a NetBoot Image 16 Step 7: Image a Computer 16 Troubleshooting 17 Additional Resources 3 Introduction Disclaimer: This technical paper is no longer being updated. Apple does not recommend or support monolithic system imaging as an installation method because of recent improvements in macOS security, hardware, management, and deployment. Apple encourages IT administrators to convert from device imaging to Apple’s Device Enrollment (formerly DEP) workflows.
    [Show full text]
  • Macquisition Quickstart Guide-V2020r1
    QUICK START GUIDE VERSION 2020 R1 INTRODUCTION MacQuisition 2020 R1 is officially supported on macOS 10.11 (El Capitan), 10.12 (Sierra), 10.13 (High Sierra), 10.14 (Mojave), and 10.15 (Catalina) systems, although 10.10 (Yosemite) and lower may potentially work. MacQuisition also boots into a forensically sound environment directly from the dongle. This QuickStart guide provides a brief explanation to get the examiner started. See the MacQuisition User Guide located on the 'Application' partition for more detailed information. Welcome to the MacQuisition Quick Start Guide MacQuisition™ is designed for triaging and imaging Mac computers. MacQuisition can be used to image Mac computers, including those with T2 chips, and also to collect data from live running Mac computers. This Quick Start guide will walk through live data collection with MacQuisition, booting a target system with MacQuisition for imaging, and running MacQuisition from an analysis Mac to acquire the target system via Target Disk Mode. Other factors that have to be considered when determining your approach, such as firmware passwords, FileVault2, T2 security chips, the file system used, and fusion drives will also be explored. The MacQuisition Device MacQuisition devices are setup up with multiple boot partitions, an application partition, a preferences partition, a license partition, and a data partition. The size of the data partition varies, depending on which MacQuisition device is purchased. Currently, there are two device sizes to choose, 1 TB or 120 GB. The devices connect via USB or USB-C cables shipped with the device. 300 Piercy Road • San Jose, CA 95138 • 408.844.8890 • https://www.blackbagtech.com Page 1 In Finder, the following partitions will appear when MacQuisition is connected: The Application partition contains the MacQuisition application, used to collect data from live systems and when running MacQuisition from an analysis Mac to acquire a target system.
    [Show full text]
  • Apple Filevault 2 on T2 Systems Running Macos Catalina 10.15 Administrative Guidance Document
    Apple FileVault 2 on T2 systems running macOS Catalina 10.15 Administrative Guidance Document Prepared By: Acumen Security, LLC www.acumensecurity.net Prepared for: Apple One Apple Park Way Cupertino, CA 95014 Document Version: 0.8 Date: April 19, 2021 Table of Contents 1 Administrative Guidance Document Introduction .............................................................. 6 1.1 TOE Overview .............................................................................................................. 6 1.1.1 TOE Product Type ................................................................................................ 6 1.2 TOE Description ........................................................................................................... 6 1.2.1 Evaluated Configuration ....................................................................................... 6 1.2.2 Physical Boundaries ........................................................................................... 12 1.3 TOE Delivery .............................................................................................................. 12 1.4 TOE Self-Tests .......................................................................................................... 12 1.4.1 Software/Firmware Integrity Tests ..................................................................... 12 2 Prerequisites for Installation ............................................................................................. 15 2.1 TOE Management Functions ....................................................................................
    [Show full text]
  • Chapter 13 MAC OS X FORENSICS
    Chapter 13 MAC OS X FORENSICS Philip Craiger and Paul Burke Abstract This paper describes procedures for conducting forensic examinations of Apple Maca running Mac OS X. The target disk mode is used to create a forensic duplicate of a Mac hard drive and preview it. Procedures are discussed for recovering evidence from allocated space, unallocated space, slack space and virtual memory. Furthermore, procedures are described for recovering trace evidence from Mac OS X default email, web browser and instant messaging applications, as well as evidence pertaining to commands executed from a terminal. Keywords: Macintosh computers, Mac OS X forensics 1. Introduction Since its introduction in 1984, the Apple Macintosh has an enjoyed a small, albeit vocal, user base. Nevertheless, it is surprising that very little has been published regarding forensic examinations of Macintosh computers. This paper describes procedures for conducting forensic examinations of Apple Macs running Mac OS X. Due to space limitations, certain as- sumptions are made to limit the scope of our coverage. These assump- tions are: (i) The forensic computer and the suspect's computer run version 10.4.3 of Mac OS X, the latest version as of November 2005; (ii) the suspect has not set the Open Firmware password (Open Firmware is a processor and system-independent boot firmware used by PowerPC- based Macs, analogous to the x86 PC BIOS); (iii) the suspect has not used encryption via the Mac OS X FileVault, a virtual volume encrypted with 128-bit AESj and (iv) the suspect's hard drive is formatted with the Hierarchical File System Plus , commonly referred to as HFS+, the default file system since Mac OS X's release in 2000.
    [Show full text]
  • Application Note
    Application Note Imaging Mac computer drives with the Forensic Falcon®-NEO Table of Contents 1.0 Introduction ................................................................................................................... 2 1.1 Macs with the Apple T2 Security Chip .............................................................................................. 2 1.1.1 Using the Mac’s Disk Utility ....................................................................................................................... 2 1.1.2 Use Targeted/Logical Imaging (File to File) ............................................................................................... 5 1.2 Apple File System (APFS) .................................................................................................................. 5 1.3 Fusion Drives ..................................................................................................................................... 6 2.0 USB-C / Thunderbolt 3 .................................................................................................... 6 2.1 Only one USB-C / Thunderbolt 3 Port ............................................................................................... 6 2.2 Only Two USB-C / Thunderbolt 3 Ports ............................................................................................ 7 2.2.1 Target Disk Mode ...................................................................................................................................... 7 2.2.2 USB Boot Client ........................................................................................................................................
    [Show full text]