I used UEFITool to modify this bootrom but found that I needed to use an older version (0.24) in order to be able to modify a bootrom rather than just extract the NVMe driver.
I read the bootrom out three times, verifying consistency with the md5sum and diff tools. I tried using the CH341a from macOS but wound up using a Linux laptop when flashrom was unable to find it. View attachment 923212 View attachment 923213 (I later found out that, if I had desoldered the chip, it has the same spacing as the SOIC-8 and would have fit perfectly into the clip.) This meant that I couldn't use an SOIC-8 clip on it, but I was able to solder some 34AWG magnet wire onto the pins and get it recognized by a CH341a.
#Uefitool 0.21.5 mac
This wound up being a little trickier, since my Mac doesn't have the J6100 connector installed for some reason, and its EFI chip is not an SOIC-8 chip like the 15" models have.
#Uefitool 0.21.5 Patch
I also opted to patch my bootrom (version 160.0.0.0) so that sleep would work with hibernatemode 25, following the guide in the wiki. Installing the pair went very simply, with the EX900's mounting notch perfectly aligning with the Mac's SSD standoff, as advertised. I'm using a 500GB HP EX900 drive with the short Sintech adapter, which came with tape pre-applied to the NVMe connector.
#Uefitool 0.21.5 pro
OSF can also dump their memory to a file on disk for later inspection.Extract Logins and PasswordsRecover usernames and passwords from recently accessedwebsites in common web browsers, including Internet Explorer, Firefox, Chrome and Opera.I've been working on upgrading my mid-2014 13" MacBook Pro (MacBookPro11,1) and thought I should share my success. Attempt to uncover passwords and other sensitive information that would otherwise be inaccessible.Select from a list of active processes on the system to inspect. Powered by Passmark's SysInfo DLL.View Active MemoryLook directly at what is currently in the systems main memory. Detailed information about the hardware a system is running on: CPU type and number of CPUs Amount and type of RAM Installed Hard Drives Connected USB devicesand much more. OSForensics can uncover the user actions performed recently on the system, including but not limited to: Opened Documents Web Browsing History Connected USB Devices Connected Network SharesCollect System InformationFind out what's inside the computer. Uncover Recent ActivityFind out what users have been up to. OSForensics can track down this ghost file data and attempt to restore it back to useable state on the hard drive. Recover Deleted FilesAfter a file has been deleted, even once removed from the recycling bin, it often still exists until another new file takes its place on the hard drive. The indexing process can open and read most popular email file formats (including pst) and identify the individual messages.This allows for a fast text content search of any emails found on a system. Powered by the technology behind Wrensoft's acclaimed Zoom Search Engine.Search for EmailsAn additional feature of being able to search within files is the ability to search email archives. This allows for lightning fast searches for text contained inside the documents. Extract Logins and Passwords.Find files quicklyOSForensics™ allows you to search for files many times faster than the search functionality in Windows.Results can be analyzed in the form of a file listing, a Thumbnail View, or a Timeline View which allows you to determine where significant file change activity has occurred.Search within FilesIf the basic file search functionality is not enough, OSForensics can also create an index of the files on a hard disk.
OSForensics™ allows you to search for files many times faster than the search functionality in Windows.ĭiscover relevant forensic evidence faster.
0 kommentar(er)
