Insights Blog

SoftBlock and Target Disk Mode

Apple computers have always included a handy feature known as Target Disk Mode (TDM), provided to allow the easy transfer of files from one computer to another.  As Macs have evolved, so has the TDM connection options.  Initially, support was provided for connection via Firewire.  Apple has extended TDM to work with Thunderbolt and USB-C.  Once a Mac is booted into TDM, it can be connected to another computer as an external hard drive.

BlackBag’s MacQuisition is designed to boot the Mac you are imaging with MacQuisition. So why would Target Disk Mode ever be needed for forensic imaging?  Well there are several scenarios where imaging via Target Disk Mode is necessary.  These include:

  • Imaging a Mac with a T2 chip when the admin password or authorization to change the secure boot settings is not available.
  • The Mac has hardware damage such as a cracked screen, broken keyboard, or faulty USB port.
  • The Mac cannot be booted with MacQuisition because the model is not supported by the version of MacQuisition being used.

If any of the scenarios are encountered, the next option is to boot to Target Disk Mode and attach the Mac to a forensic system running MacQuisition for imaging.

To Access Target Disk Mode on a Mac:

  • Press the power button on the Mac
  • Hold the <Option/Alt> key to access the Start-Up Manager (this is a safety check to determine if a firmware password is present)
  • Once the Start-Up Manager is visible hold the <T> key until a Target Disk Mode symbol appears on the screen.

The symbol(s) will indicate which interface(s) are available on that Mac.

  • Thunderbolt 3 (USB-C)
  • USB-C
  • Thunderbolt 2
  • FireWire

For information on connecting the computers with the correct cable review the information about Target Disk Mode provided by Apple here.

Remember, Target Disk Mode was created for transferring files either to or from a Mac. Consequently, Target Disk Mode itself does not provide any write-blocking capabilities.  A hardware write-blocker can be used, provided you have a write-blocking device for the TDM interface being used.   BlackBag’s SoftBlock provides a simpler solution.   SoftBlock is a software write-blocker designed to run on macOS.  Installing SoftBlock on the forensic system used for imaging, protects the data on any device attached, including Target Disk Mode devices.

BlackBag Team

With hundreds of years of combined experience in law enforcement,
forensics research and development, and corporate investigations, our team understands forensics. Digital Forensics is more challenging than ever before due to advancements in technology. The BlackBag Team exists to find solutions for these challenges, thereby empowering our customers to seek, reveal, and preserve the truth.Meet some of our experts at https://www.blackbagtech.com/company/our-team/
BlackBag Team

Latest posts by BlackBag Team (see all)