Establishing Forensic Acquisition Procedures for the Apple Fusion Drive
Primary Investigator:
Marcus Thompson
Adolfo Montironi
Abstract
Fusion Drive technology was introduced by Apple in 2012 and it is still part of the company’s products in 2017. A Fusion Drive is a logical storage device which merges a flash SSD with a magnetic HDD, with the purpose of combining the high performance of the flash SSD with the available capacity of the magnetic HDD. In spite of the fact that Fusion Drives have been in the market for more than five years, a practical procedure to acquire the information stored in these drives has not been established yet. This study will further the analysis of Fusion Drives by proposing a practical procedure to acquire them using core utilities from the Mac OS operating system. Through this method, forensic practitioners will be able to complete the acquisition phase of a digital investigation process with a deep understanding of the technical details involved.