To image a Macintosh

This article covers the basics of acquiring a disk image from a Macintosh computer. It details a number of techniques that are available to the forensic examiner and covers other related issues. These include the use of open Firmware to determine the date and time of the internal computer clock. Once the disk image has been obtained, the article then considers a number of ways that the Macintosh can be used in the examination of the image. The article concludes with a look at the future of the Macintosh computer in the light of the move to the Intel chipset.