You're in over your head. You can absolutely get cheap converters for 2017 macbook pro drives. There are also created/birth times in the filesystem that are harder to modify. https://www.amazon.com/dp/B09PFQX277 and OWC made one as well.
The Amazon link does not list the A1708 as one of the units it is compatible with. The reason the A1708 SSD is so hard to find is because it has a different form factor from everything else, being "wide" instead of "long", as the video shows. That's entirely the point, this one specific SSD from Apple is so much harder to find than all the rest of the SSD/nvme drives.
Birth time can bet set with the 'SetFile -d" command-line program that comes with developer tools.
Took longer to come here and reverify than to find.
I just double checked with a coreos developer at Apple, and birth time is indeed immutable. This is not the same as creation time. You were right however and I linked the wrong adaptors in the beginning. But if you think pro forensics companies don’t have adaptors lol. Even us plebs can get them.
If you check all three of those products, none were available in early 2020 when the FBI imaged the laptop.
You can check with anonymous OS developers at Apple, but it doesn't change the fact. I've updated the blogpost to show how to change the birth time (specifically, with 'SetFile -d'). I show a screenshot where I set the birth time to 11/11/11 11:11:11.
I was linked to this page by Marcy/Emptywheel on twitter, and I was hoping someone would answer.
What keeps bothering me is how was Marc Isaac, the repair shop guy, able to access the contents of the hard drive?
I've watched many videos of Luis Rossman doing macbook repair, and they usually end the same way:
-LR has the motherboard out.
-He attaches his connectors directly to the motherboard.
-An apple logo comes on the screen and LR announces that it works, its fixed.
-cleaning and reassembly of the macbook is completely ignored b/c straightforward.
-at no point does LR need or have the password.
I've never been an apple/mac guy, but as a windows person, I have had passwords on my computers and phones since at least 2015 and I dont even travel to foreign countries for business.
Does this make sense? How did Marc Isaac access the files? aren't they encrypted?
Otherwise it looks like (to me) someone sent Hunter a malicious link or file, he clicked on it, and the hackers just downloaded everything from the cloud. then they put it on a broken computer.
possibly one owned by Isaac or Giuliani and 'laundered it' through Isaac
You're in over your head. You can absolutely get cheap converters for 2017 macbook pro drives. There are also created/birth times in the filesystem that are harder to modify. https://www.amazon.com/dp/B09PFQX277 and OWC made one as well.
One of us is over his head.
The Amazon link does not list the A1708 as one of the units it is compatible with. The reason the A1708 SSD is so hard to find is because it has a different form factor from everything else, being "wide" instead of "long", as the video shows. That's entirely the point, this one specific SSD from Apple is so much harder to find than all the rest of the SSD/nvme drives.
Birth time can bet set with the 'SetFile -d" command-line program that comes with developer tools.
https://digitalintelligence.com/store/products/tda7-7-pcie-ssd-adapter-for-apple-2016-products
https://www.acelab.eu.com/news/the-new-macbook-pro-a1706a1708-20162017-pcie-ssd-adapter-is-in-stock-now
https://www.recoveryrus.com/product/macbook-pro-a1708-pcie-ssd-recovery-adapter-smart/
Took longer to come here and reverify than to find.
I just double checked with a coreos developer at Apple, and birth time is indeed immutable. This is not the same as creation time. You were right however and I linked the wrong adaptors in the beginning. But if you think pro forensics companies don’t have adaptors lol. Even us plebs can get them.
If you check all three of those products, none were available in early 2020 when the FBI imaged the laptop.
You can check with anonymous OS developers at Apple, but it doesn't change the fact. I've updated the blogpost to show how to change the birth time (specifically, with 'SetFile -d'). I show a screenshot where I set the birth time to 11/11/11 11:11:11.
Hi Robert,
I was linked to this page by Marcy/Emptywheel on twitter, and I was hoping someone would answer.
What keeps bothering me is how was Marc Isaac, the repair shop guy, able to access the contents of the hard drive?
I've watched many videos of Luis Rossman doing macbook repair, and they usually end the same way:
-LR has the motherboard out.
-He attaches his connectors directly to the motherboard.
-An apple logo comes on the screen and LR announces that it works, its fixed.
-cleaning and reassembly of the macbook is completely ignored b/c straightforward.
-at no point does LR need or have the password.
I've never been an apple/mac guy, but as a windows person, I have had passwords on my computers and phones since at least 2015 and I dont even travel to foreign countries for business.
Does this make sense? How did Marc Isaac access the files? aren't they encrypted?
Otherwise it looks like (to me) someone sent Hunter a malicious link or file, he clicked on it, and the hackers just downloaded everything from the cloud. then they put it on a broken computer.
possibly one owned by Isaac or Giuliani and 'laundered it' through Isaac
Does this make sense?
Thanks
Aaron
Modern macbooks with soldered SSDs have connectors to access the drive when the motherboard isn't turned on.
Older macbooks allow you to either remove the SSD or to access as a "target disk" via the thunderbolt or USB connector.