

- #APPLE SERIAL NUMBER BY FORENSIC ANALYSIS SERIAL NUMBERS#
- #APPLE SERIAL NUMBER BY FORENSIC ANALYSIS PASSWORD#
- #APPLE SERIAL NUMBER BY FORENSIC ANALYSIS MAC#
- #APPLE SERIAL NUMBER BY FORENSIC ANALYSIS WINDOWS#
One online service can be found on Apple’s official website, and can help you determine the model of your device, whether it has a valid purchase date, and whether it’s still covered by Apple’s technical support. Your Apple device’s serial number can be found either in the device’s settings menu or printed on the device.

The most straight forward way to decode your serial number is to type it in to an online service. So let’s get to breaking down their impenetrable code. This information can be valuable for troubleshooting issues with your device or just for curiosity’s sake.
#APPLE SERIAL NUMBER BY FORENSIC ANALYSIS SERIAL NUMBERS#
This is the mode necessary for forensic acquisition without other tools.Ĭlick on the links below to go to pages that provide simple instructions to complete the tasks necessary.The serial numbers of Apple products contain a codified language that can give you information about your Apple device that can’t be found through any other means-everything from the location where it was manufactured, the date it was manufactured, and much more. “T” – Holding down the T key while powering up places the computer into Target Disk Mode. Once the imaging process is complete, you would come here to gather the data that you could otherwise have collected in Single User Mode. The only reason you would use this is if FileVault was enabled. ⌘ + R – This key combination is used to start the computer in Recovery Mode. When the computer is started in Single User Mode, it allows for polling the computer for a number of very important computer forensic information. ⌘ + S – This key combination is used to start the computer in Single User Mode.
#APPLE SERIAL NUMBER BY FORENSIC ANALYSIS PASSWORD#
Also used to determine if a Firmware Password has been deployed. “option” key – Used to start the computer to the point where it shows various boot drives. This is by no means an exhaustive “startup key” list. Press and hold them first, and then press the power button. These instructions are deployed simultaneous with pressing the power button.
#APPLE SERIAL NUMBER BY FORENSIC ANALYSIS MAC#
The 4 “MUST KNOW” Mac Special Startup Key Combinationsĭuring various phases of the acquisition process, the Mac needs to be started in modes other than “normal”. This section of our site is dedicated to properly acquiring Mac drives in a variety of scenarios and at no cost.
#APPLE SERIAL NUMBER BY FORENSIC ANALYSIS WINDOWS#
It is true that there are some methods used on Windows computers that would work on Mac computers once the hard drive is removed, but they will not image FileVault enabled drives with CoreStorage, and they will not rebuild images on Macs using Fusion drive technology. When considering where to spend money, this should be high on the list, if you can afford it.įortunately, there are other ways to create forensic images of Mac computers. Secondly, MacQuisition is so intuitive and easy to use that a tutorial would be moot. Firstly, this section is about being able to properly acquire forensic images on a budget (and MacQuisition is NOT cheap). You will notice that this section of the website has a number of tutorials, and yet it does not have one for MacQuisition acquisitions. No other method or tool will extract this image. One method that comes to mind is forensically acquiring a drive that is FileVault enabled, and you only have the Recovery Key.

It allows acquisitions using methods that are simply not possible in any other manner. This tool, made by a company named BlackBag Technologies is truly the last word in commercial Mac acquisition tools. That is what this section of our website is devoted to. When there is little competition, (and little demand), cost of these tools can be extremely prohibitive, and examiners look for workarounds. Mac computers, most likely due to their smaller market share, have a smaller amount of tools with which a digital forensics examiner can work with. That was the genesis of this corner of our website.

Our research has determined that there are a lot of “bits” of advice on the Internet about Mac forensics, but little in the way of “easy to follow” concise start to finish tutorials that cover the various scenarios. This is akin to saying that because you can drive a car, you must be able to fly a plane, because they are both modes of travel. Many labs that have been doing forensics on Windows computers think they can just pull a hard drive from a Mac, image it the way they always have, and then examine it. There is no question that Mac computers are gaining market share, and as forensic examiners, we see more of them in the lab. PI, GSEC, GCFE, GCFA, EnCE, BAI, CDRP, CEH
