Time Machine
Definition
Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and later) it uses snapshot-based local backups and APFS replication to the destination. Lets you walk file state back across time.
- Vendor
- Apple, built into macOS
- HFS+ method
- Incremental hard-link trees in Backups.backupdb
- APFS method
- Snapshot-based local backups plus APFS replication
- APFS since
- macOS 11 Big Sur and later
Common questions
Why does the storage format matter to an examiner recovering Time Machine data?+
The HFS+ hard-link scheme and the APFS snapshot scheme store history in structurally different ways, so the parsing approach and the tools used to walk file state back across time have to match the underlying file system, not just the Time Machine label.
Can Time Machine snapshots reveal a file's state before it was deleted or edited?+
Yes, that is its forensic value: each backup or snapshot preserves file states as of that point in time, so an examiner can compare successive snapshots to see when a file was created, changed or removed, even if the current copy is gone.
Related terms
- APFS
- Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes...
- Keychain
- Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the...
- Launchd
- macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and...
- Property List (Plist)
- Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login...
- Unified Logging
- macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of...