Notifications
Clear all
Topic starter
02/08/2012 6:13 pm
I've come across a folder named"xxx's Macbook.Air.sparsebundle" within an investigation.
Within one of the files in the "bands" is a picture of interest, which was found through sector level carving.
From everything I have looked at an read, this seems to be a mac backup folder. However it would be useful to establish where the file was backed up from.
Is there a way of extracting or imaging the backup file from a windows investigation system?