.

Encase 5.05 and Mac Drives

<<

harky

Newbie
Newbie

Posts: 10

Joined: Wed Dec 19, 2007 4:42 pm

Location: Germantown Hills, IL (seeking relocation to Chicago area)

Post Thu Jan 31, 2008 4:58 pm

Encase 5.05 and Mac Drives

I have 2 hard drives, one from a notebook and one from a desktop. I know they are from Macs, but I'm not sure what version of Mac OS X or filesystem. I got them acquired using Helix and LinEn, and added them to a case and verified them in EnCase Forensic 5.05j.

However, EnCase does not recognize the filesystems. It just says "Unknown" in the report tab for filesystem, and when I expand the drive, I get "C" and nothing else. Scrolling through the text of the drive, I can see that data is there, so I believe the acquisition was successful, just not sure what's going on.

Any ideas would be appreciated.

Thanks much.
Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
<<

harky

Newbie
Newbie

Posts: 10

Joined: Wed Dec 19, 2007 4:42 pm

Location: Germantown Hills, IL (seeking relocation to Chicago area)

Post Thu Feb 07, 2008 11:42 am

Re: Encase 5.05 and Mac Drives

We have found a solution in the EnCase forums. Apparently EnCase (I am not sure if version 6 fixes this) does not recognize the GUID partition table used in newer Macs with EFI. Following is a manual fix from Bill Siebert in the EnCase forums to get the filesystem to show:

1) Search the disk for "HFS"
2) Wait a few minutes and refresh the search hits
3) In the search hits, find the HFS at the top of the list and click on it
4) Switch to disk view where the HFS keyword was found
5) Move back 2 sectors, right click, select Add Partition, choose HFS+
6) Let the file systems rebuild
7) VOILA! The The folders and files will appear

Note: some people have reported having to use the second search hit, rather than the first.
Daniel Harkness
MCSA, MCSE, CCE
MS - CprE and InfAs
BS - CprE
BS - ComS
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1911

Joined: Mon Dec 11, 2006 3:23 pm

Post Thu Feb 07, 2008 1:10 pm

Re: Encase 5.05 and Mac Drives

Sorry no one here was able to provide you with a solution to your question. Thank you for returning and posting the answer, it's appreciated.
<<

don

User avatar

Administrator
Administrator

Posts: 4260

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Feb 07, 2008 2:01 pm

Re: Encase 5.05 and Mac Drives

Thanks Harky. We could always use some good additions to the Forensics Board, even if you do answer your own question.  ;)

Don
CISSP, MCSE, CSTA, Security+ SME

Return to Forensics

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software