Time Capsule archival?

[ScottishCaptain]

Greetings to all.

Quick question: is the Time Machine disk archival option a bitwise copy?

I have a client here who foolishly deleted some files from a TC hosted AFP share. Of course the files were not backed up, because they were hosted on the very device that the Time Machine backups reside on. I think he figured that the device backed itself up somehow or something.

Anyways, these files were deleted from the AFP share, and once it was realized what had happened the device was unplugged immediately and sent to me. So now I am faced with the task of recovering files from this thing somehow.

The one caveat is this: I can't open the device. The Time Capsule itself is perfectly functioning and the owner doesn't want to risk fudging up the rubber bottom.

So what I'm wondering is this- is the Time Capsule's archive option in the Airport Utility a bitwise copy (equivalent to dumping the entire internal drive with `dd`)? People say it is extremely slow to complete so I think it might be, but I'm not sure.

I'm trying to figure out if I can use the archive feature to dump the entire internal disk to an external USB drive, and then run HFS+ recovery on the external USB drive copy and recover his files.

Edit: I guess I should stipulate on the condition- I can't pry the unit open unless I absolutely have to. Buying a cheap 1TB disk drive to archive the TC to and recover off of is easier and cheaper then potentially ruining a $300 device, but if push comes to shove then I can try and peel off the base and pull the drive.

-SC

 

[priitv8]

The first copy of a file/directory is a bitwise replica of the original. The next (aka incremental) ones are simply hard links.
http://pondini.org/TM/Works.html
A good undelete program might recover your data.
PS Over-the-LAN backups are contained in special files called sparsebundles. In that sense, did the user really delete individual files from inside the TM backup sparsebundle? Or did he/she delete the whole sparsebundle? In the latter case you should have even better chance to recover it with an HFS+ undelete program.

 

[ScottishCaptain]

No...

He was hosting information on the AFP share of the Time Capsule. That information was deleted. I wanted to know if the Time Capsule's "archive" option was a block copy of the internal drive to an external one, which one could then run a data recovery program on without removing the TC's hard disk.

I know the Time Capsule runs NetBSD, so what I wanted to know was if the "archive" option was functionally equivalent to `dd if=/dev/sd0 of=/dev/sd1`, where sd1 is the device node of the external USB disk drive.

In any case, it doesn't matter.

I landed up opening the Time Capsule with a hair dryer. It was not fun and I will never again buy another Apple product with a rubber base. Took around an hour just to get the base off cleanly without destroying the adhesive, another few hours to run Data Rescue 3 on the drive, and about 20 minutes to replace the rubber base and heat it up enough to reactivate the glue.

I love disposable network appliances .

-SC

 

[priitv8]

Sorry, I completely misunderstood your question.

 

[opinio]

I understood everything up until the point where the OP said:

"so what I wanted to know was if the "archive" option was functionally equivalent to `dd if=/dev/sd0 of=/dev/sd1`, where sd1 is the device node of the external USB disk drive"

 

[priitv8]

I understood everything up until the point where the OP said:

I assume TC sports some archive command in the AirPort Utility.
dd is a Unix Disk Dump command.