Briefly describe acquisition methods in macOS.
What will be an ideal response?
ANSWER: To examine a computer running macOS, you need to make an image of the drive, using the same techniques described in Chapter 5. You should be aware of some exceptions, however, caused by Apple design and engineering. (In addition, removing the drive from a Mac Mini case is difficult, and attempting to do so without Apple factory training could damage the computer. A MacBook Air poses similar problems, as you need special Apple screwdrivers to open the case.) You need a macOS-compatible forensic boot CD/DVD to make an image, which then must be written to an external drive, such as a FireWire or USB drive. Larger macOS systems are constructed much like desktop PCs, making removal of the hard drive easier.
You might also like to view...
The pair of wires that runs from the central office into our home or business is known as
a. a toll-connecting trunk b. an intertoll trunk c. the local loop d. an interexchange circuit
The ________ option starts an animation sequence for the selected slide element directly following the completion of the preceding animation
A) Before Next B) Follow Previous C) Prior to Next D) After Previous
Which of the following is NOT a type of inspector in Word 2010?
A) Document Properties B) Invisible Content C) Hidden Text D) Formatting Features
The owner of a file or folder may deny Administrators access to a resource. But an administrator can exercisethe optional right to take ________of any resource to gain access to it
Fill in the blank(s) with correct word