The Mac mini is a small, low cost Mac that offers a lot of features in a small package. It's a nice entry level machine for new and old Mac users. The low price along with it's rich feature set make it an ideal machine for general users.
Although a forensic examiner can connect the Mac mini to their forensic workstation via Target Disk Mode and use software write blocking, the ideal way to image the suspect drive and examine it is to remove the hard drive and connect it with a hardware write blocker. Because of the Mac mini's small size the internal components are tightly packed inside.
To remove the hard drive you will need a small computer screw driver (Phillips head) and a thin 1.5 inch putty knife. You may want to sharpen the edge using some fie grit sand paper first to make it easier to slide into the Mac mini case.
Instructions:
Place the Mac mini upside down on a cloth or towel.
Slide your putty knife in the seam of the Mac mini as shown. Pull back on the putty knife until the white plastic pops up. Do the same on the other side.
Pull the main unit up and out of the case.
To remove the wireless antenna there are two tabs under it that you can gentely squeeze together. You may want to hold the antenna down a bit as it has a spring below it and the spring may shoot off.
Remove the screws in all four corners of the CD/DVD drive.
Lift the CD/DVD unit and hard drive from the motherboard below. Be careful as the hard drive is still attached to the motherboard via a thin ribbon cable and the Airport antenna is still connected too.
Remove the 2 screws on each side of the hard drive. Then slide the drive out.
You can now connect the 2.5" SATA drive (IDE in the older Mac mini G4 models) to a hardware write blocker to make a forensically sound aquisition of the suspect drive.
