Quantcast
Channel: Apple – Forensic Artifacts
Viewing all articles
Browse latest Browse all 10

Using Apple Time Capsule with Microsoft Windows

$
0
0

John Lukach

AirPort Utility 5.6.1 for Windows

The AirPort Utility for Windows allows Microsoft computers using Bonjour to access the Apple Time Capsule hard disk. The drive is available as a network share through UNC mapping on your PC. The binary data stored in HKEY_Users\S-1-5-1234567890-1234567890-123456789-1000\Software\AppleInc.\Preferences\com.apple.airport.diskagent will provide confirmation of which volume is associated with your Apple Time Capsule. An external USB connection is available so you could have two volumes listed.

If the end-user setup Windows Backups than you will be able to gain additional insight into the size of the disk with the free space available that may be beneficial in identifying the external USB drive.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\ScheduledParams

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\ScheduledParams\Rules\

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\ScheduledParams\PresentableName

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\ScheduledParams\UniqueName

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\TargetDevices

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsBackup\UserDataExclusions

User defined inclusions are listed as numbered keys under the Rules folder containing specific paths.


Viewing all articles
Browse latest Browse all 10

Trending Articles