Question

How do I view iWorks files in FTK Core/Central/Plus?

 

Prerequisites

  • OSX Machine
  • Administrator account credentials for the OSX system
  • AccessDataiWorkService-macos-installer-x64-1.0.180.pkg

Installing the Service on OSX

  1. Install the service on a OSX machine.
  2. Verify the following:
    • Check install location is populated: /Library/AccessDataiWorkService/
    • Check for the background process: /Library/LaunchDaemons/
    • Check for the active process in Activity Monitor: FileApi

Configuring the Service on OSX

  1. Navigate to /tmp.
  2. Create the required directory structure:
    • Open Terminal and enter: 
      • mkdir -p /tmp/Exterro/IWorksService/tempfiles
  3. Ensure the tempfiles folder has full read/write permissions.
    • Click Finder > Go > Go to Folder and enter:
      • /tmp/Exterro/IWorksService
    • Click File > Get Info.
    • Click the chevron > beside Sharing & Permissions.
    • Ensure Everyone has Read & Write privileges.

Verifying the Service is Working

  1. Open a browser.
  2. Enter the following URL:
  3. Allow the Automation (for Pages, Numbers and Keynote) when prompted.
    • If this is not allowed, the service will fail to run as expected.
  4. Navigate to /tmp/Exterro/IWorksService/tempfiles.
  5. Verify the following files have been created:
    • ADTest.pdf
    • ADtest.key
    • ADtest.numbers
    • ADtest.pages

Configuring ADGWeblabSelfhost.exe.config

  1. Navigate to :\Program Files\AccessData\Forensic Tools\7.5\bin\.
  2. Open ADGWeblabSelfhost.exe.config in a text editor.
  3. Edit the following keys:
    • BreadMacFileServiceUrl
      • Value = Address of iWork Service machine. Ensure the url uses http, not https.
    • UseMacIworkServiceForPDFConversion
      • Value = true
  4. Save the changes.
  5. Restart ExterroSelfHostService.

PDF Conversion: Required for each document.

  1. To view iWorks files now that you have fully configured the service and FTK, open a case with iWorks files.
  2. Select an iWorks file.
  3. Select the Annotate viewer to begin PDF conversion.
    • This will run in the background and store results in the case folder. 
  4. Once a file is converted, it will be displayed in the viewer.

Alternatively, Bulk Imaging can be used to start conversion for all iWorks documents.

Uninstalling the iWorks Service

  1. Open Terminal and enter:
    • cd /Library/AccessDataiWorkService//
  2. To uninstall enter:
    • sudo bash ./uninstall.sh
      • If prompted, enter the administrator credentials.