Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 55 guests and 5 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Encase 5.05 and Mac Drives
EH-Net
May 24, 2012, 10:41:04 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Encase 5.05 and Mac Drives  (Read 25596 times)
0 Members and 2 Guests are viewing this topic.
harky
Newbie
*
Offline Offline

Posts: 10

Hard-working IT professional relocating to NE IL


View Profile
« on: January 31, 2008, 03:58:46 PM »

I have 2 hard drives, one from a notebook and one from a desktop. I know they are from Macs, but I'm not sure what version of Mac OS X or filesystem. I got them acquired using Helix and LinEn, and added them to a case and verified them in EnCase Forensic 5.05j.

However, EnCase does not recognize the filesystems. It just says "Unknown" in the report tab for filesystem, and when I expand the drive, I get "C" and nothing else. Scrolling through the text of the drive, I can see that data is there, so I believe the acquisition was successful, just not sure what's going on.

Any ideas would be appreciated.

Thanks much.
Logged

Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
harky
Newbie
*
Offline Offline

Posts: 10

Hard-working IT professional relocating to NE IL


View Profile
« Reply #1 on: February 07, 2008, 10:42:05 AM »

We have found a solution in the EnCase forums. Apparently EnCase (I am not sure if version 6 fixes this) does not recognize the GUID partition table used in newer Macs with EFI. Following is a manual fix from Bill Siebert in the EnCase forums to get the filesystem to show:

1) Search the disk for "HFS"
2) Wait a few minutes and refresh the search hits
3) In the search hits, find the HFS at the top of the list and click on it
4) Switch to disk view where the HFS keyword was found
5) Move back 2 sectors, right click, select Add Partition, choose HFS+
6) Let the file systems rebuild
7) VOILA! The The folders and files will appear

Note: some people have reported having to use the second search hit, rather than the first.
Logged

Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
BillV
Hero Member
*****
Offline Offline

Posts: 1830


View Profile WWW
« Reply #2 on: February 07, 2008, 12:10:17 PM »

Sorry no one here was able to provide you with a solution to your question. Thank you for returning and posting the answer, it's appreciated.
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Online Online

Posts: 3915


Editor-In-Chief


View Profile WWW
« Reply #3 on: February 07, 2008, 01:01:07 PM »

Thanks Harky. We could always use some good additions to the Forensics Board, even if you do answer your own question.  Wink

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.247 seconds with 22 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.