Last week we released Atola Insight Forensic 4.9, which includes Thunderbolt extension module. This extension provides Insight users with the capability to image, calculate hash and perform other forensically sound operations on all generations of MacBooks.
This guide will explain how to connect a MacBook to Insight using Thunderbolt extension.
Extension and cables
Thunderbolt extension enables Insight to operate on all MacBooks with FireWire, Thunderbolt 2 and Thunderbolt 3 interfaces. There is no need to remove the SSD, Thunderbolt extension allows connecting the whole Apple laptop to Insight.
The extension module comes with:
- Thunderbolt 3 to Thunderbolt 2 adapter (by Apple)
- Thunderbolt 2 to FireWire adapter (by Apple)
- FireWire cable
Connecting MacBook to DiskSense unit
1. Connect MacBook to DiskSense unit with the help of Thunderbolt extension and the FireWire cable (NB Both MacBook and DiskSense have to be turned off). Use the adapters to connect to the MacBooks with Thunderbolt 2 or Thunderbolt 3 interface.
2. Start DiskSense unit and launch Atola Insight Forensic on your computer.
3. Boot the MacBook in Target Disk Mode. To do that, start it up while holding down the T key. You should see a Firewire or Thunderbolt icon displayed on screen signifying that Target Disk Mode is detected and working.
4. Select Identify device option in the pop-up window.
5. In Source – Select MacBook Case window click Add new case button.
6. If this is the first time this MacBook is identified by Insight, you need to enter the Serial number of the MacBook in the pop-up window and click OK. The device has been identified. (NB MacBook’s serial number can be found on the bottom case).
Now you can perform these operations with the connected MacBook:
- hash calculation
- hash verification
- media scan
- file recovery
When a MacBook is connected to Insight for a subsequent session, it is possible to simply select the appropriate case from the table.