For comprehensive training on how to handle, image and examine an Apple Time Capsule, we recommend attending our Essential Forensic Techniques II course.
This article will cover a very basic explanation on how to use MacQuisition to image an Apple Time Capsule.
- Power off the Time Capsule.
- It is necessary to remove the drive from inside the Time Capsule. A good resource for tearing down a Time Capsule can be found on the iFixit website (www.ifixit.com).
- Once the drive has been removed from the Time Capsule hardware, place the drive in a drive enclosure or docking station.
- Insert MacQuisition into a Mac computer that can be used as a host imaging machine.
- If you have write-blocking software such as SoftBlock on the host Mac, then you can run MacQuisition live and attach the Time Capsule drive as read-only. If you do not have a write-blocker or write-blocking software, we recommend booting to MacQuisition and then attach the Time Capsule drive. Note: When booted to MacQuisition, attached drives are mounted as read-only by default.
- MacQuisition will detect the attached Time Capsule drive from enclosure or docking station and display in the Image Device view.
- Select on the attached Time Capsule drive from the list of disks in the Image Device view and continue with imaging process.
For detailed instructions on creating an image with MacQuistion, the user guide and quickstart guide can be downloaded from the Product Documentation page here https://www.blackbagtech.com/bbtsoftware/productdocumentation/.