Booting an Apple Macintosh in target disk mode allows computer forensic examiners to copy relevant files from the internal drive on a Mac computer. Removing hard drives instead from a Mac computer can be time consuming and result in damage to the system when not performed properly. Therefore, target disk mode allows forensic examiners to access the internal Mac drive as an external hard drive from another Mac or a Windows PC.
Target disk mode requires the host computer (systems accessing the Mac) to connect via a FireWire port (or Thunderbolt with newer Macs) to the target Mac. If there is not a FireWire port on the Windows host computer, you will need to purchase an adapter for the system. Many laptops have PCMCIA or ExpressCard/34 slots that allow insertion of a FireWire card. Make sure the cable being used fits the FireWire connector on the Mac since there are different shape connectors for FireWire standards.
WINDOWS HOST COMPUTER SETUP
When using a Windows PC to access the target Mac hard drive, there are a few things to prepare:
- Make sure you have a FireWire port and the appropriate cable. You can purchase FireWire ExpressCard/34 adapters for laptops that include an ExpressCard slot.
- Software installed on the host computer that can recognize a Mac (HFS, HFS+ etc.) file system. MacDrive from Mediafour (www.mediafour.com/products/macdrive/) is a well-known and useful tool for accessing Mac drives in target mode or Mac formatted hard drives you receive.
- SafeCopy 3.0 and Harvester from Pinpoint Labs (www.pinpointlabs.com) are popular applications that can copy and even keyword filter the files on a Mac drive once it is connected and mounted on the host computer.
USING FIREWIRE TARGET DISK MODE
Once your host Windows computer is set up and ready to access the target Mac, follow these steps:
- Make sure the target Mac computer is turned off.
- Connect the FireWire cable from the Windows host to the target Mac.
- Turn on the target Mac while holding down the “T” key until you see the FireWire icon. The hard drive of the target computer should become available on the host computer, and you will then be able to access the files from the Mac hard drive.
- Use a defensible copy utility or hard drive imaging application to collect the relevant contents.
- When the copy is completed, you may turn off the target Mac computer and disconnect the FireWire cable.
USING THUNDERBOLT TARGET DISK MODE
Newer Apple Macintosh computers with Thunderbolt ports (faster than FireWire) will also display the Thunderbolt icon when going into target mode. If the target Mac only displays the FireWire icon as shown above, then you will need to use the FireWire port to access the Mac internal drive from the host computer.
MACBOOK THUNDERBOLT PORT
Thunderbolt ports for Windows PC’s are available. However at this time, Pinpoint Labs has not yet tested access to a Mac in target mode using a Windows PC via a Thunderbolt connection. We will provide a follow-up note at a later date once we have had a chance to physically determine its effectiveness during a computer forensic collection.
Apple Macintosh computers continue to increase in popularity. Corporate IT managers, litigation support professionals, and computer forensic examiners are often tasked with preserving data from Mac hard drives. Booting a Mac in target disk mode is one way to gain access to relevant files without disassembling the system, which in most circumstances would void the warranty and/or damage the system. SafeCopy 3.0 and Harvester from Pinpoint Labs (www.pinpointlabs.com) are great utilities for fast and safe copying of files from Mac and Windows PC’s.