With the smaller and more compact design of computers these days, it's becoming increasingly difficult to take them apart to get access to the hard drive for forensic acquisition and examination. Should you choose to take the Mac apart to access the hard drive for forensic investigation, Apple has created service manuals that outline the procedures necessary to remove the hard drive from Apple computers. Mac laptops are very difficult to take apart to access the hard drive because of the compact size and placement of the drive. A much easier option to taking the Mac apart to access the hard drive for forensic acquisition is to use Target Disk Mode. This mounts the suspect Mac as a FireWire device to allow for acquisition without removing the hard drive from the Mac. You can find information on acquiring via Target Disk Mode here on the MacForensicsLab.com web site. Make sure you disable Disk Arbitration using MacForensicsLab before connecting a suspect drive using Target Disk Mode to prevent writing to the device.
Apple Service Manuals for many Macs can be found at this site.
Take apart guides for Apple PowerBooks and MacBooks with full color photos can be found here at PowerBookMedic.com
Take apart guides with full color photos for PowerBooks and iPods can be found here at iFixIt.com
