Mac OS X Forensics
Never give up, the answer is right in front of you...
-
Our Sponsors
-
Custom Search
Time Machine
and Time Capsule
Probably the coolest feature for all of us forensically. Time Machine will continually archive files to a secondary hard drive. Time Machine is the software built-in to Leopard that allows for archiving to a local or network connected drive.
Time Capsule is Apple's newest piece of hardware. It is the Airport Extreme 802.11n Base Station with a 500GB or 1TB inside.
UPDATE: Apple has updated the firmware for the Airport Extreme Base Station and released a new Airport Express that now support Airdisk and Time Machine! What does this mean for us?
Time Machine uses hard links to files to continuously create what looks like a full backup of a user's hard drive. The backup will continue to be created as long as there is room on the designated Time Machine drive. Once space becomes limited, oldest files will begin to be removed from the archive.
Time Machine
The picture show a clip of what Time Machine looks like. If you have great eyes, you don't need to read any further. For the rest of us, let me describe what is in the picture. Across the bottom of the screen is a bar that makes it simply for a user to bring files back from the past. In the middle is the date and time of the selected file. To the left is a Cancel button and to the right is a Restore button. Thats it! Very easy stuff!
Finder view of Time Machine backups
The picture above is a look at the hard drive being used for Time Machine. Notice the organized folders including dates and file structure! Time Machine makes generous use of "hard links" for efficiency on the drive. The first run of Time Machine is a full backup of the Mac. Subsequent runs are backups of the files that have changed. The folders will have the appearance of containing a full backup of the Mac everytime though! That is because of "hard links". These links will point back to the original file, always.
Read more about Time Machine with FileVault enabled here.
Probably the coolest feature for all of us forensically. Time Machine will continually archive files to a secondary hard drive. Time Machine is the software built-in to Leopard that allows for archiving to a local or network connected drive.
Time Capsule is Apple's newest piece of hardware. It is the Airport Extreme 802.11n Base Station with a 500GB or 1TB inside.
UPDATE: Apple has updated the firmware for the Airport Extreme Base Station and released a new Airport Express that now support Airdisk and Time Machine! What does this mean for us?
- When you walk into a home, don't just look for a computer! You probably already knew this, but even more importantly, the point of access to the internet now might also have a complete backup of all of the data you are looking for.
- Multiple Macs can use one drive to make Time Machine archives over the network. Whether the Mac is using wired or wireless, the Mac can use the attached hard drive as a Time Machine drive. One drive/many computers!
- In the case of Time Capsule, the router will not look like anything more than a router at first glance. Be cognizant that you may have 500GB or 1TB of data in your hands.
Time Machine uses hard links to files to continuously create what looks like a full backup of a user's hard drive. The backup will continue to be created as long as there is room on the designated Time Machine drive. Once space becomes limited, oldest files will begin to be removed from the archive.
Time Machine
The picture show a clip of what Time Machine looks like. If you have great eyes, you don't need to read any further. For the rest of us, let me describe what is in the picture. Across the bottom of the screen is a bar that makes it simply for a user to bring files back from the past. In the middle is the date and time of the selected file. To the left is a Cancel button and to the right is a Restore button. Thats it! Very easy stuff!
Finder view of Time Machine backups
The picture above is a look at the hard drive being used for Time Machine. Notice the organized folders including dates and file structure! Time Machine makes generous use of "hard links" for efficiency on the drive. The first run of Time Machine is a full backup of the Mac. Subsequent runs are backups of the files that have changed. The folders will have the appearance of containing a full backup of the Mac everytime though! That is because of "hard links". These links will point back to the original file, always.
Read more about Time Machine with FileVault enabled here.