Application Note

Using Apple’s Target Disk Mode to access a Mac’s internal drive as a Source drive (For use with or FireWire) with the Forensic Falcon™ or Talon® Ultimate

Introduction: This document provides instructions on how to access a Mac’s internal drive to be used as a Source drive on the Forensic Falcon or Talon Ultimate using either the Mac’s on-board Thunderbolt or FireWire port. This method will allow the Falcon or Talon Ultimate to see the Mac’s internal drive as a Source drive. The drive can then be imaged or hashed using the Falcon or Talon Ultimate.

The Talon Ultimate FireWire ports can be enabled with purchase of the FireWire option. The Falcon FireWire ports are already enabled and do not require any option purchased.

Sections: I – Requirements II – Enabling Target Disk Mode on the Mac III – What to Expect on the Falcon/Talon Ultimate

Section I – Requirements: A Forensic Falcon or Talon Ultimate (the Talon Ultimate must have the FireWire option purchased and enabled. A Mac with: o At least one native Thunderbolt/Thunderbolt 2 or FireWire port o Target Disk Mode support (If you are unsure whether the Mac supports Target Disk Mode, please contact Apple). . For Macs with Thunderbolt/Thunderbolt 2 – Apple’s Thunderbolt to FireWire adapter and a FireWire 800 to 800 cable (one is included with the Falcon) . For Macs with FireWire 800 – A FireWire 800 to 800 cable (one is included with the Falcon, but not with the Talon Ultimate) . For Macs with FireWire 400 – A FireWire 400 to 800 adapter with a FireWire 800 to 800 cable (one FireWire 800 to 800 cable is included with the Falcon but not with the Talon Ultimate) or a FireWire 400 to 800 cable.

Page 1 of 2 APPNOTE-Mac_Internal_Drive_as_Source –v1

Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com Application Note

Section II – Enabling Target Disk Mode on the Mac: The Mac has to be booted up into Target Disk Mode (TDM). TDM is a boot mode unique to Macs which bypasses the and enables its drives to behave as Thunderbolt or FireWire external mass storage device. To enable Target Disk mode: 1. With the Mac turned off, connect the FireWire or Thunderbolt cable as follows: a. Using a Thunderbolt port: i. Connect the Apple Thunderbolt to FireWire adapter to the Mac’s Thunderbolt port. ii. Connect one end of the FireWire 800 to 800 cable to the Thunderbolt to FireWire adapter. iii. Do not connect the other end of the cable to the Falcon/Talon Ultimate yet. b. Using a FireWire 800 port: i. Connect one end of the FireWire 800 to 800 cable to to the Mac’s FireWire 800 port. ii. Do not connect the other end of the cable to the Falcon/Talon Ultimate yet. c. Using a FireWire 400 port with a FireWire 400 to 800 adapter: i. Connect the 400 adapter to the Mac’s FireWire 400 port. ii. Connect one end of the FireWire 800 to 800 cable to to the Mac’s FireWire 800 port. iii. Do not connect the other end of the cable to the Falcon/Talon Ultimate yet. d. Using a FireWire 400 port with a FireWire 400 to 800 cable: i. Connect the FireWire 400 to 800 cable to the Mac’s FireWire 400 port. ii. Do not connect the other end of the cable to the Falcon/Talon Ultimate yet. 2. Turn on the Mac and immediately press and hold the T key on the keyboard. 3. Keep holding the T key until a FireWire or Thunderbolt icon. When the FireWire or Thunderbolt icon appears, release the T key. The Mac should now be in Target Disk Mode. 4. Connect the other end of the cable to the Falcon/Talon Ultimate.

Notes: For portable Macs (e.g. MacBook, MacBook Pro), it is highly recommended that the power supply be connected to provide continuous power to the device. If the Mac is not into TDM, please contact Apple for support for Target Disk Mode.

IV – What to Expect on The Falcon/Talon Ultimate The Falcon/Talon Ultimate will treat the internal drive on the Mac as any drive connected to the Source position (write-protected). The internal drive on the Mac, like any other drive connected to a Source port on the Falcon, should now appear on the following tasks: Imaging (Source) Hash USB Device

Page 2 of 2 APPNOTE-Mac_Internal_Drive_as_Source –v1

Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com