±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36290
New Yesterday: 2 Visitors: 139

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Time Capsule / Time Machine "bands" data

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Time Capsule / Time Machine "bands" data

Post Posted: Nov 04, 14 04:35

Hello everyone,

I have the misfortune of requiring the extraction of e-mails from an Apple Time Capsule device. As some of you may be aware, there's a special format it stores data in, thousands of seemingly random files under a folder entitled "bands."

So, I need to convert this into the standard data, then re-process it with FTK in order to extract all e-mails.

Has anyone done this before? Do you know what could best convert this from the "bands" to standard data?



Re: Time Capsule / Time Machine "bands" data

Post Posted: Nov 06, 14 06:21

You'll either need a Mac or, if you have a forensic image of the Time Capsule, you can use the Windows version of BlackBag's BlackLight to parse it. The latter route could be very slow, however.

If you do have a Mac available, Back-In-Time is useful for browsing and extracting data from Time Machines - www.tri-edre.com/engli...ntime.html


Senior Member

Re: Time Capsule / Time Machine "bands" data

Post Posted: Nov 06, 14 21:06

Restore disk from your E01 onto another HDD. Then connect it either to your your MAC or cloned original MAC and try it that way restoring it. Time machine BKP file structure is different on Image than in Live , you have links to data.  

Page 1 of 1