Page 1

TIME MACHINE & MACOSBACKUPS · A GUIDE FOR UK LAWYERS Time Machine and macOS Backup Analysis The Second Machine That Remembers What the First One Deleted COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM PRIOR-STATE & VERSION ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a second machine that remembers 03 How Time Machine and macOS backups work 04 What backups preserve 05 Recovering prior states and deleted data 06 Authentication, dating and honest limits 07 Deployment: the deleted file, the earlier version, the aged-out log 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Time Machine keeps regular, versioned backups of a Mac, so a backup is a second machine that remembers what the first one deleted, preserving deleted files, earlier document versions and aged-out artefacts at many past points, often outside the encryption and reach of the live machine.

§ 02 · FIRST PRINCIPLES The problem in plain English: a second machine that remembers

§ 03 · HOW BACKUP S WORK How Time Machine and macOS backups work CONFIGURED REGULAR BACKUP VERSIONED STATES EXTERNAL DRIVE RECOVER PAST STATE