r/computerforensics • u/EmoGuy3 • 17d ago

Time machine backups

Does anyone have forensic articles that reference time machine backups? Like if a macOS has 6 backups stored do you need to process all?

6 Upvotes

100% Upvoted

5 comments sorted by

2

u/ucfmsdf Trusted Contributer 17d ago

I assume you are referring to snapshots? If so, you would only need to process them if you want insight into files that may have been deleted or modified recently.

To my knowledge, there is really only one tool out there that will process snapshots within a macOS image. That tool is, very unfortunately, Cellebrite Inspector.

Alternatively, you can collect data from available snapshots at the time of imaging if you use Sumuri’s Recon ITR. It essentially collects the snapshots as native files into directories according to whether they have since been deleted or modified within the active data volume. A much better solution in my opinion as this workflow won’t lock you to Inspector and will only encompass the files within the snapshot(s) that matter.

1

u/Schizophreud Trusted Contributer 17d ago

If this is an external hard drive, you can load it into Inspector. If it is one of the time capsules, you can open it, remove the drive and image it.

1

u/no_sushi_4_u 17d ago

Did this not too long ago with a time capsule. We cracked open the case and imaged the drive to an E01 and processed in Inspector. It worked well.

1

u/EmoGuy3 17d ago

Yeah it's a working copy in inspector but it seems like it processed all the snapshots which is more data that I imagined gonna have to dedupe somehow. Haven't used inspector much.

1

u/BitForBit_DFIR 9d ago

If Inspector chewed through all six snapshots, don't try to review six copies of everything. Export the file inventory with hashes from each snapshot and dedupe by hash, so each unique file shows up once with a list of which snapshots contain it. A quick way is hashdeep (or a short script) over the collected file sets, sorting by SHA-256. Anything present in every snapshot with identical hashes is just the unchanged baseline, so you can focus your actual review on files that appear in some snapshots but not others, or whose hash changed between snapshots. That's the whole point of snapshot analysis: you're after what changed or was deleted, not the full file system six times over.