Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 19 guests and 2 members online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Encase 5.05 and Mac Drives
Ethical Hacker Community Forums
November 20, 2008, 09:56:13 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Encase 5.05 and Mac Drives  (Read 7556 times)
0 Members and 1 Guest are viewing this topic.
harky
Newbie
*
Offline Offline

Posts: 9

Graduate student seeking Digital Forensics career


View Profile
« on: January 31, 2008, 03:58:46 PM »

I have 2 hard drives, one from a notebook and one from a desktop. I know they are from Macs, but I'm not sure what version of Mac OS X or filesystem. I got them acquired using Helix and LinEn, and added them to a case and verified them in EnCase Forensic 5.05j.

However, EnCase does not recognize the filesystems. It just says "Unknown" in the report tab for filesystem, and when I expand the drive, I get "C" and nothing else. Scrolling through the text of the drive, I can see that data is there, so I believe the acquisition was successful, just not sure what's going on.

Any ideas would be appreciated.

Thanks much.
Logged

Iowa State University
MS Student: CprE and InfAs
BS-CprE & BS-ComS
Graduating: Dec. 2008
harky
Newbie
*
Offline Offline

Posts: 9

Graduate student seeking Digital Forensics career


View Profile
« Reply #1 on: February 07, 2008, 10:42:05 AM »

We have found a solution in the EnCase forums. Apparently EnCase (I am not sure if version 6 fixes this) does not recognize the GUID partition table used in newer Macs with EFI. Following is a manual fix from Bill Siebert in the EnCase forums to get the filesystem to show:

1) Search the disk for "HFS"
2) Wait a few minutes and refresh the search hits
3) In the search hits, find the HFS at the top of the list and click on it
4) Switch to disk view where the HFS keyword was found
5) Move back 2 sectors, right click, select Add Partition, choose HFS+
6) Let the file systems rebuild
7) VOILA! The The folders and files will appear

Note: some people have reported having to use the second search hit, rather than the first.
Logged

Iowa State University
MS Student: CprE and InfAs
BS-CprE & BS-ComS
Graduating: Dec. 2008
BillV
Hero Member
*****
Offline Offline

Posts: 862


View Profile
« Reply #2 on: February 07, 2008, 12:10:17 PM »

Sorry no one here was able to provide you with a solution to your question. Thank you for returning and posting the answer, it's appreciated.
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2347


Editor-In-Chief


View Profile WWW
« Reply #3 on: February 07, 2008, 01:01:07 PM »

Thanks Harky. We could always use some good additions to the Forensics Board, even if you do answer your own question.  Wink

Don
Logged

CISSP, MCSE, CEH, Security+ SME
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.031 seconds with 23 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
During the most recent election, I:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.