Page 1
TIME MACHINE & MACOSBACKUPS · A GUIDE FOR UK LAWYERS Time Machine and macOS Backup Analysis The Second Machine That Remembers What the First One Deleted COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM PRIOR-STATE & VERSION ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a second machine that remembers 03 How Time Machine and macOS backups work 04 What backups preserve 05 Recovering prior states and deleted data 06 Authentication, dating and honest limits 07 Deployment: the deleted file, the earlier version, the aged-out log 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Time Machine keeps regular, versioned backups of a Mac, so a backup is a second machine that remembers what the first one deleted, preserving deleted files, earlier document versions and aged-out artefacts at many past points, often outside the encryption and reach of the live machine.
§ 02 · FIRST PRINCIPLES The problem in plain English: a second machine that remembers
§ 03 · HOW BACKUP S WORK How Time Machine and macOS backups work CONFIGURED REGULAR BACKUP VERSIONED STATES EXTERNAL DRIVE RECOVER PAST STATE
Page 2
§ 04 · WHATBACKUPSPRESERVE What backups preserve
§ 05 · RECOVERINGPRIORSTATES Recovering prior states and deleted data
§ 06 · AUTHENTICATIONANDHONESTLIMITS Authentication, dating and honest limits
§ 07 · DEPLOYMENT Deployment: the deleted file, the earlier version, the aged-out log
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LIVE MAC MACHINE BACKUP / 3RD-PART Y TIME ICLOUD CLONES / DRIVE SYNC BACKUP APFS DELETED / SNAPSHOTS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDFILETHEBACKUPDRIVEKEPT EXAMPLE2 · THEEARLIERVERSIONTHATEXPOSEDTHEBACKDATING EXAMPLE3 · THELOCKEDMACANDTHEBACKUPTHATANSWERED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR A BACKUP ANALYSIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The backup-analysis checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions A file was deleted from the Mac. Can a backup still have it? Can backups prove a document was altered after it was dated? The Mac is locked and we cannot access it. Does that end things? Can a backup recover system logs that have rotated away? How reliable is a backup as evidence of timing? What if there is no Time Machine backup?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Time Machine And MacOS Backup Analysis, Computer Forensics Lab, https://e-discovery.uk/library/time-machine-and-macos-backup-analysis/pdf.