Inside the Core
The Macintosh Forensic Podcast


Follow Us

Categories

general
podcasts

Archives

2011
November
June

2010
December
July
June
March

2009
December
November
October
August
July
June
May

October 2017
S M T W T F S
     
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30 31

Syndication

iTunes Enhanced Mp3 Version

Disclaimer:
The Inside the Core podcast is provided for entertainment only. Any information, techniques, software or equipment that is discussed should be researched, tested and validated prior to use. This podcast is not a substitute for specialized training that is required for computer forensics. The topics of discussion and/or opinions are those of the host(s) and do not reflect the views of the hosts employers or former employers. Discussion of content, goods, or services provided by outside entities does not imply endorsement. Nothing in the podcast should be construed as an offer, solicitation or recommendation to buy or sell any specific products or training.

BootCamp & Single User Mode Listener Jay pointed out that when the selected startup disk is BootCamp, you will not be able to boot into Single User Mode.

You will also not be able to boot using any other startup option except for Startup Manager (Option Key) and Terminal Disk Mode (T Key). You can reset the PRAM (CMD, Option, P, R Keys) which will reset the startup disk to the OS X startup disk. Remember, this will also reset your date and time and remove the Open Firmware password if one was set.

When you boot with the option key and see the BootCamp Disk selected as default, this indicates that it is the selected startup disk. You will need to use a different method to attain the date/time and drive info.

You could use forensic Boot CDs such as Macquisiton, SPADA or Raptor to boot the system for imaging or preview. Just make sure that the solution you are using will boot a Mac.

Thanks to Jay for his email and tip.

Be Safe,
The MacDudes
Category:general -- posted at: 10:30am PDT