This is the second post in my series on different ways to image a Mac. My was on how to image a Mac with a bootable Linux distro. This post will cover another option, creating an image by booting a Mac into single-user mode. I plan on following up this post with posts on creating a live image and how to mount and work with FileVault encryption after an image is complete. Single-user mode is a limited shell that a Mac can boot into before fully loading the operating system.

In single-user mode, the internal hard drive is mounted read only and a limited set of commands are available. Once in single-user mode, a USB drive can be attached and dd can be used to create an image. In order to mount the USB drive, the internal drive needs to be changed to read/write to create a mount point. While not as forensically sound as using a write blocker or booting into a Linux distro, less changes are made than fully booting the operating system to take a live image. This may be a good option where it is acceptable to get a live image, but the examiner wishes to minimize changes to the hard drive. Another benefit is that if there is FileVault encryption, the encrypted drive is decrypted after a username and password are supplied.

The system I used for testing was a Mac Mini, OS X Version 10.8.5 with one hard drive. Three partitions were created by default during the initial setup: an EFI partition, a MacOSX partition, and a recovery partition. I tested two scenarios, one without encryption and one with encryption (FileVault 2). For each step I will cover both scenarios. The high level steps are: 1) Boot into single-user mode 2) Determine the disk to image 3) Mount the USB drive that will hold the image 4) Run the dd command to create the image [Edit 8/1/2016] Please read the comments as well. I have had some people in the community provide some great tips and suggestions since this was posted! Step 1 - Boot into single-user mode The first step is to boot into single-user mode.

While the system is booting, select COMMAND-S to enter single-user mode. I usually hold down this key combo before I even power on the system so I don't accidentally 'miss' it. At this time, I do not to have the USB drive that will hold the image plugged in. Unencrypted If the system is not encrypted a bunch of white text will scroll and finally present a shell with root. After the username and password are entered, the single-user boot process continues and drops into a shell similar to the unencrypted system. Step 2 - Determine what to image The next step is to determine what block device to copy for the dd command. In order to determine this, use the ls command to get a list of the available disks under the /dev directory.

How to Resize Boot Camp Partition in Mac OS X. Boot Camp is a dual boot feature of Mac that allows you to create a separate partition and serves to run two different operating systems on. You deallocate the markers that tell the disk, and subsequently, the operating system using the disk which pieces of the disk space are available for use, and which are considered free. Another way to accomplish the backup is manually, using the dd command. But in our case, let’s focus on the partition table. Again, we will use the dd.

As I mentioned before, I prefer to do this before I plug the USB drive in so I don't have to try and guess which is the internal hard drive and which is the USB drive. (OS X has a disk utility called diskutil that presents more verbose information about the disks, however, it is not available in single-user mode). From these results I can tell that disk0s1 is the EFI partition, and disk0s3 is an HFS partition. Disk0s2 is showing as 'data'. This happens when the file command can't tell what the file is, it just gives a generic 'data' in response - which makes sense if the partition is encrypted. Some quick math give us the partition sizes: EFI disk0s1 size = 409600 sectors X 512 bytes per sector = 209715200 bytes = ~210 MB HFS disk0s3 size = 4096 bytes per block X 158692 blocks = 650002432 bytes = ~650 MB Next, I want to see what size disk0s2 is.

I can use fdisk /dev/disk0s2 for this. Rdisk1 size = 4096 bytes per block X 243898823 blocks = 08 bytes =~ 999 GB /dev/disk0s2 and /dev/disk1 are about the same size, 999GB, and /dev/disk1 is a readable HFS partition. Based on my experience and the outputs above, it appears /dev/disk1 is the OS X partition (disk0s2) in a decrypted state. For imaging, either /dev/disk0 or /dev/disk1 can be used. If /dev/disk0 is used, all three partitions will be captured, but the data in the MacOSX partition - /dev/disk0s2 will remain in the encrypted state.

If /dev/disk1 is imaged, it will have the MacOSX data in an decrypted state,but will not have partition 1 (EFI partition) and partition 3 (Recovery partition). I like to grab both /dev/disk0 and /dev/disk1. Step 3 - Mount the external USB Drive The next step is to mount the external USB drive so the image can be saved onto it. The USB drive can be formatted in FAT32 or HFS. FAT32 has the benefit of both Windows and Mac being able to access it, but it has a 4GB file size limit.

Best Answer: GIMP is an image editor. You don't install fonts in an application. All applications use the fonts that are in one of the 'Fonts' folder. Put fonts at. My tutorial on how you can download fonts on your Mac for Gimp. Fonts for gimp on mac.