[iranfromthezoo]

Hey guys, some of you know my job is being a firefighter. Well I am considering helping the PD with the child abuse (aka child porn) cases. I was wondering how could I learn how to hack the mac and view the deleted files and different things like that? I am the only Apple user with the PD and FD. So we were wondering what ways could I learn? Could I call Apple in Cupertino and ask for them to help? The PC is easy to hack but we kind of need a new mac hacker.


Does that make sense? Thanks guys, Iran.

[OreoCookie]

I assume you are interested in computer forensics, i. e. somebody has recovered a computer and you're trying to find the data on the harddrive. You can reset passwords via the install CD. This is easy. It's more problematic when that person has installed a firmware password, you simply take out the harddrive and connect it to another Mac.

One definite tool is Data Rescue: unlike Disk Warrior, it doesn't try to repair a volume, but accesses it read-only and you can copy files. This should help to recover deleted files and volumes (unless they have been overwritten with 0s or so). It will also not be able to help you if that person has put his/her kiddie porn on an encrypted disk image or has activated File Vault (you can see the disk image, but not open it, unless you have the password).

[Hal Itosis]

Never tried it myself: http://www.MacForensicsLab.com/
(from SubRosaSoft... makers of: CopyCatX, DasBoot and FileSalvage)

[larkost]

If you are doing this for actual investigations, then you need to get trained on actual criminal forensics. There are a lot of chain-of-evidence details that you will completely botch (making the evidence inadmissible in a trial) if you don't get properly trained. The technical details after that are going to be relatively easy.

[iranfromthezoo]

Originally Posted by larkost 

If you are doing this for actual investigations, then you need to get trained on actual criminal forensics. There are a lot of chain-of-evidence details that you will completely botch (making the evidence inadmissible in a trial) if you don't get properly trained. The technical details after that are going to be relatively easy.

I understand that. We've got that part down. We are just looking into different ways to hack into the mac.

[turtle777]

What do you mean by "hack into the Mac" ?

What state is the Mac in ?
Do you have physical access ?
Password protected account ?
Firmware password ?
File Vault ?
Erased HD ?

A bit more details would be helpful.

-t

[goMac]

Use file restore software. Seriously, that's the only way.

"Hacking" the files back by hand is such a complex job, I doubt that even the people who write the file system would want to do that. There are trained professionals who are paid hundreds of thousands of dollars to do that sort of work.

Computer forensic people use actual commercial tools.

[iranfromthezoo]

Originally Posted by turtle777 

What do you mean by "hack into the Mac" ?

What state is the Mac in ?
Do you have physical access ?
Password protected account ?
Firmware password ?
File Vault ?
Erased HD ?

A bit more details would be helpful.

-t

Mississippi

No we do not

yes and it is an erased HD.

[turtle777]

Originally Posted by iranfromthezoo 

Mississippi

I meant "condition", not literally state.

Originally Posted by iranfromthezoo 

yes and it is an erased HD.

Then Data Rescue is your best bet.

And for future reference: recovering deleted data is not really hacking

-t