Imaging a Time Capsule
- Tear down the Time Capsule (iFixit provides a detailed guide)
- Clone the Time Capsule hard disk to another hard disk (drive-to-drive copy). I used a hardware duplicator for this step. You'll need the cloned drive later.
Data preview
In my case the sparsebundle files were stored in "/volumes/Backup/ShareRoot". FTK Imager will just show a number of files of 8 MB in size.
Data extraction
Steps to follow
- Connect the cloned drive in RW mode to your Mac and choose not to use it as a Time Machine drive.
- Connect to your Mac an additional drive of the same capacity as the Time Capsule drive. In case your Mac doesn't have enough USB/FW ports, you can copy (drag and drop) the sparsebundle files to the internal drive on your Mac.
- Mount a sparsebundle file in RO mode by typing in the terminal:
hdiutil attach -readonly yourfilename.sparsebundle
- List now all connected drives:
diskutil list
- Clone the mounted sparsebundle to your destination drive (you must be root for this):
dcfldd if=/dev/diskMountedSparseBundle of=/dev/diskDestinationDrive conv=noerror,sync
Once finished with dcfldd, unplug the destination drive. As a final step, capture a compressed forensic image of the destination drive. A compressed E01 image will be more or less the same size as the relative sparsebundle file.
You have to repeat all the steps for each sparsebundle file.
You have to repeat all the steps for each sparsebundle file.
If you know a quicker way, please let me know.
