MacOSX, Tutorials

How to forensically mount/image a (Time Capsule) Sparsebundle

Quick walkthrough to backup, mount and image a TC sparse bundle forensically

  1. Connect to the TC using AirportUtility
  2. Backup the internal volume to an external USB-Drive
    (HDD has to be min. same size)
  3. Mount the created sparse bundles
    hdiutil attach –readonly –nomount ComputerName.sparsebundle/
  4. Create the forensic image
    using MacOSForensicImager

Quelle: Crack and Image a FileVault Sparsebundle. AppleExaminer-Downloads