Time Capsule / Time...
 
Notifications
Clear all

Time Capsule / Time Machine "bands" data

3 Posts
3 Users
0 Likes
1,457 Views
Samuel1
(@samuel1)
Posts: 63
Trusted Member
Topic starter
 

Hello everyone,

I have the misfortune of requiring the extraction of e-mails from an Apple Time Capsule device. As some of you may be aware, there's a special format it stores data in, thousands of seemingly random files under a folder entitled "bands."

So, I need to convert this into the standard data, then re-process it with FTK in order to extract all e-mails.

Has anyone done this before? Do you know what could best convert this from the "bands" to standard data?

Thanks!

 
Posted : 04/11/2014 4:35 am
 lars
(@lars)
Posts: 31
Eminent Member
 

You'll either need a Mac or, if you have a forensic image of the Time Capsule, you can use the Windows version of BlackBag's BlackLight to parse it. The latter route could be very slow, however.

If you do have a Mac available, Back-In-Time is useful for browsing and extracting data from Time Machines - http//www.tri-edre.com/english/backintime.html

Cheers,
Lars

 
Posted : 06/11/2014 6:21 am
pajkow
(@pajkow)
Posts: 81
Estimable Member
 

Restore disk from your E01 onto another HDD. Then connect it either to your your MAC or cloned original MAC and try it that way restoring it. Time machine BKP file structure is different on Image than in Live , you have links to data.

 
Posted : 06/11/2014 9:06 pm
Share: