Forensic Image of a 24" iMac

I have a 24" iMac and a LogicCube Dossier.  I need to make a forensic image of the iMac.  I have looked up the directions on removing the hard drive from the iMac and that does not seem feasible.

The configuration I have tried so far is iMac to PC via Firewire and then PC to LogicCube via USB.  The software estimates that the image will take close to 15 years to complete.
LVL 3
LouSch7Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

strungCommented:
Would Carbon Copy Cloner do what you want?  http://www.bombich.com/ccc_features.html
0
LouSch7Author Commented:
Carbon Copy Cloner does appear to be a decent program however, I doubt they would be willing to testify in court if/when called upon to provide legal documentation of their software's processes and backup the legitimacy of the image.
0
dalesitCommented:
CCC would not give you a forensic image, as there would not be the hashing of the drive image to prove that it had not been tampered with.

There is a good page on mac forensics at http://www.peachpit.com/articles/article.aspx?p=707908&seqNum=2

However, using the setup you specify, with the Mac in Target Disk Mode (hold down T when switching on the Mac), it will be available to the forensic cloning PC as an external firewire HD, operating at either 400Mbps or 800Mbps dependent upon the firewire interfaces available.

The USB connection to the LogicCube Dossier should operate at the same speed as any other PC being cloned would operate. Just double check that you are indeed connecting over the USB connection as a USB 2.0 connection (ie 480Mbps) rather than USB 1.0 (12Mbps). This will have a major effect upon your speeds. Not all USB ports are created equal, so you might find that the PC has a mixture of USB 1.0 and USB 2.0 ports.

Cheers,

Joel
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
LouSch7Author Commented:
Thank you all for your responses, in the end the best solution was to go through the lengthy 15 step process of removing the screen and taking out the hard drive.  More and more reasons everyday to stick with PC.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Apple Hardware

From novice to tech pro — start learning today.