By Kevin J. Ripa
PI, GSEC, GCFE, GCFA, EnCE, BAI, CDRP, CEH
Mar 10, 2016

This paper outlines various destination drives and connection methods, while conducting forensic imaging of a MacBook Air Solid State Drive.

Details of Subject Machine

MacBook Air 11”
128 GB SSD
4 GB RAM
Brand new as of February 28, 2016
Imaging took place on February 29 and March 1, 2016

Imaging Process

Imaging was performed by booting to a MacQuisition USB drive and using MacQuisition to control the imaging process.

Destination media was plugged directly into the subject machine in various ways as outlined below. Hashing was not performed on any images except as indicated to show the time tax due to hashing.

Destination media interface was SATA unless otherwise noted.

Benchmark Times

Drive                                      Connection               Hashed          Time
HDD 5400 RPM                     Thunderbolt              No                   27 minutes
HDD 7200 RPM                     Thunderbolt              No                   24 minutes
SSD                                         Thunderbolt              No                   7.5 minutes
SSD (m-SATA)                       USB 3                          No                   7.5 minutes
SSD                                         USB 3                          No                   8.2 minutes
HDD 7200 RPM                     USB 3                          No                   20 minutes
HDD 7200 RPM (FVE)          USB 3                          No                   16 minutes
HDD 7200 RPM                     USB 3                          MD5                21 minutes
HDD 7200 RPM                     USB 3                          SHA1               21 minutes
HDD 7200 RPM                     USB 3                          SHA256          32 minutes

Image performed Target Disk Mode to SSD at 64KB Block Size, No Hash, 53 minutes
Image performed Target Disk Mode to SSD at 512KB Block Size, No Hash, 20 minutes

Observations

Surprisingly, USB 3 performed better than Thunderbolt.
FileVault imaged faster than no encryption.
Clearly, block size has considerable impact on Target Disk Mode acquisition.



ARTICLES

    UPCOMING EVENTS

    • Events are coming soon, stay tuned!

    RULINGS