Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 39 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Encase 5.05 and Mac Drives
EH-Net
May 23, 2013, 12:44:23 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Encase 5.05 and Mac Drives  (Read 26601 times)
0 Members and 1 Guest are viewing this topic.
harky
Newbie
*
Offline Offline

Posts: 10

Hard-working IT professional relocating to NE IL


View Profile
« on: January 31, 2008, 03:58:46 PM »

I have 2 hard drives, one from a notebook and one from a desktop. I know they are from Macs, but I'm not sure what version of Mac OS X or filesystem. I got them acquired using Helix and LinEn, and added them to a case and verified them in EnCase Forensic 5.05j.

However, EnCase does not recognize the filesystems. It just says "Unknown" in the report tab for filesystem, and when I expand the drive, I get "C" and nothing else. Scrolling through the text of the drive, I can see that data is there, so I believe the acquisition was successful, just not sure what's going on.

Any ideas would be appreciated.

Thanks much.
Logged

Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
harky
Newbie
*
Offline Offline

Posts: 10

Hard-working IT professional relocating to NE IL


View Profile
« Reply #1 on: February 07, 2008, 10:42:05 AM »

We have found a solution in the EnCase forums. Apparently EnCase (I am not sure if version 6 fixes this) does not recognize the GUID partition table used in newer Macs with EFI. Following is a manual fix from Bill Siebert in the EnCase forums to get the filesystem to show:

1) Search the disk for "HFS"
2) Wait a few minutes and refresh the search hits
3) In the search hits, find the HFS at the top of the list and click on it
4) Switch to disk view where the HFS keyword was found
5) Move back 2 sectors, right click, select Add Partition, choose HFS+
6) Let the file systems rebuild
7) VOILA! The The folders and files will appear

Note: some people have reported having to use the second search hit, rather than the first.
Logged

Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #2 on: February 07, 2008, 12:10:17 PM »

Sorry no one here was able to provide you with a solution to your question. Thank you for returning and posting the answer, it's appreciated.
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Online Online

Posts: 4167


Editor-In-Chief


View Profile WWW
« Reply #3 on: February 07, 2008, 01:01:07 PM »

Thanks Harky. We could always use some good additions to the Forensics Board, even if you do answer your own question.  Wink

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.123 seconds with 24 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.