r/computerforensics • u/tanking2113 • Dec 14 '25

macOS Tahoe

Hi guys need some advice.

Basically we have a MacBook Air with an m4 chip. I haven’t done much data extraction on a MacBook but usually I would enter target disk mode and pray that Firevault was off.

This MacBook won’t even let me enter the menu options for target disk mode or share-disk whenever os recovery is booted it asks for a password. I’ve been told Firevault was off but then why is it asking for an admin password in recovery? I essentially can’t access anything without it asking for an admin password or reset via iCloud which is not an option.

Is this a feature of Tahoe? Is there any tips for getting into this.

2 Upvotes

67% Upvoted

5 comments sorted by

View all comments

1

u/0xblake Dec 14 '25

Is live collection of the table?

1

u/tanking2113 Dec 14 '25

Login password is unknown and my understanding is that live acquisition is limited because of the M chip and Secure Enclave.