Once you have a quick and dirty deployment of Deep Freeze you’ll likely at some point want to make changes to the contents of your drive. You can thaw the partition in DFXControl when you need to make changes: Open DFXControl from /Applications/Faronics Provide the DF User Name as the user name provided earlier Provide the Password as what you provided earlier In Boot Control, change to Boot Thawed and click on the Restart button You can then make changes following the restart and refreeze when you’re ready to do so.
-
-
Deep Freeze, All Quick & Dirty-like
Deep Freeze allows us to lock down a hard drive from allowing change, using 3rd party software and no server. Ideal for lab environments, although there are a number of strategies for using it otherwise. To get started, first download Deep Freeze from www.faronics.com and then extract the Faronics Deep Freeze for Mac .dmg file. To install and freeze the system: Open the DFX_4.51.2200.0365.pkg (or whatever the latest version of Deep Freeze is). Click on Continue at the Welcome to the Deep Freeze Installer Click on Continue at the Important Information screen Click on Continue at the Software License Agreement screen Click on Agree at the EULA statement At the…
-
Preserving the Chain of Custody for Mac OS X
One of the most important aspects of performing forensics work in Mac OS X is to write-block the volumes that you are inspecting in order to maintain the chain of custody for the evidence (or potential evidence). One way to do this is to use a physical write blocker so that when you plug a USB, SATA, eSATA or other type of drive into the write blocker you will only be presented with a read only volume on the computer. For example, some good write blockers can be found at Digital Intelligence. WeibeTech also makes a nice USB device for write blocking on the Mac. But this can get kinda’…