![]() Without the password, you could be dead in the water-on new Macs. With this increased security on new M1 and T2 chipsets, the investigator must have the user admin password. Apple devices with this new M1 and T2 encryption chips have encryption enabled by default, so digital forensic investigators cannot freely collect data and physical images from these Macs. Apple’s APFS file system features protection but is easier to bypass if there’s a potential software integration the investigator can use. Moving to these processors means a couple of significant changes for digital forensics. Apple has returned to building its chips, which are structured around an ARM processor-like the chips used in devices such as smartphones, tablets, and wearable mobile technology. ![]() Apple previously made its chipsets before utilizing Intel’s Core chips. One of the reasons an individual may choose to buy an Apple device over others is that the built-in security options are more robust and challenging to bypass. With digital forensic professionals seeing more Mac laptops and other Apple devices more often, we created this guide to identify a few challenges that law enforcement and digital investigators may encounter and provide solutions and best practices for tackling these obstacles both in the field and the lab.Ĭhallenge # 1 : FILEVAULT2-ENABLED SYSTEMS For law enforcement, finding and dealing with Apple devices in the field can create confusion and headaches without first understanding some critical differences between Operating systems (HFS+, APFS, and Windows file systems).
0 Comments
Leave a Reply. |