BlackBag Technologies, Inc

BlackBag Technologies, Inc.FireWire Target Disk Mode Guidelines

Copyright © 2008 BlackBag Technologies, Inc. All rights reserved.www.blackbagtech.com

Overview

This document is a guide for using the FireWire Target Disk Mode (TDM) in a forensicallysound manner on Macintosh systems. For clarification purposes, the system we are copying datafrom is the Suspect System and the system we are copying the data to is the Acquisition System.Please read this entire set of guidelines before beginning.

The Suspect System must be started from the powered-off state; if the system you encounter ispowered on, make sure you consider the implications of shutting down before completing theoperation. When a Suspect System is booted into TDM, the firmware boot parameters arechanged to make the internal drive on the Suspect System appear as an external drive to theAcquisition System via a FireWire bus connection. These changes take place at the firmwarelevel before the Suspect System’s operating system starts up. TDM is not a permanent changeand will not persist the next time the Suspect System is booted under normal conditions. If theAcquisition System is configured in a forensically sound manner, it will be able to see and readfrom the Suspect System drive over the FireWire connection without attempting to mountpartitions, thus avoiding any writes or changes to the Suspect System.

Warning

It should be noted that setting up a forensically sound Acquisition System and using TDM doesnot guarantee that attempts to write to a Suspect System will be stopped, as a physical write-blocking device would do. The user must not attempt any commands that may change data onthe Suspect System. By setting up a forensically sound Mac OS X Acquisition System, theautomatic behavior of Mac OS X to mount partitions is disabled. Carelessness or confusionabout the Systems can result in data changes on the Suspect System. Make sure you understandthese distinctions and practice on non-evidence systems before attempting data transfer on a realSuspect System.



Guideline 11. Confirm the Acquisition system is correctly configured as a forensically sound system.

Indicators of sound configuration:• DiskArbitration is set to “off” (10.3 - Panther)• AutoDiskMounting is set to “off” (10.2 – Jaguar)

1. Confirm you have power connected to both systems, especially if they are Notebooks.

Guideline 21. Boot (power on) Suspect System while holding down the “Option” key. Continue

pressing the “Option” key until you see the drive icon(s). Be patient and continue pressingthe “Option” key until you see either of the following screens:

This screen indicates that a firmware password is NOT enabled.

This screen indicates that a firmware password IS enabled.

1. If a firmware password IS enabled, you will need to consider resetting the password orphysically removing the drive before proceeding.

If you see this screen, you have just written to the suspect drive – power off immediately usingthe actual “power” button.



2. Once confirmed that a firmware password is NOT enabled, power off the SuspectSystem using the actual “power” button. Note: you may need to press the button for acouple of seconds.

Guideline 31. Verify there is no open firmware password (see Guideline 2).

2. Use a FireWire cable to connect the Suspect and Acquisition Systems. Note: bothsystems should be “off” (powered down).

3. Boot (power on) the Suspect System while pressing the “T” key. It may take up to, ormore than, 30 seconds to see the blue screen. Be patient and continue pressing the “T” key.

A blue screen with the yellow FireWire symbol should appear, signaling the system is inFireWire Target Disk Mode (TDM).

Guideline 41. Boot (power on) Acquisition System (DiskArbitration/AutoDiskMounting – OFF per

Guideline 1). Note: if the volumes mount on the desktop, you have just written to theSuspect System. Unmount / Eject the volume(s) that mounted by first selecting the volume,then pressing the “ “ and the “E” keys at the same time. Once the icon disappears,Shutdown via the Menu Bar by selecting the Apple icon, then selecting Shutdown. Returnto Guideline 1.

2. Identify the FireWire Target System.To identify the system:• Launch terminal and enter the following command: ioreg –c “IOMedia”.• Look for FireWire Target Media.• Proceed with imaging/read-only mounting desired volume(s), etc.

Guideline 51. When imaging/mounting is complete, shut down the system in reverse order.

To shut down the system:• Shut down the Acquisition System first (via the Menu Bar - Select the Apple icon,

then select Shutdown).• Turn off (power down) the Suspect System using the actual “power” button.

For more information, refer to the following Apple website: http://docs.info.apple.com/article.html?artnum=58583

Technology

BlackBag Technologies, Inc