Search  Rules  Login
TheBat English » The Bat! - Configuring the E-mail Client
Pages: 1
RSS
.TBB header & footer, Getting lost MESSAGE.TBB files from image
 
#1
0  
I wonder what headers and footers MESSAGE.TBB files have?  I had a disk disaster and am trying to retrieve mail files from hard disk images.  I think a header might be "\x20\x06\x79\x19" (in hex), but I don't know if that's right, or if there may be a footer symbol/string/magic number also.

Can anyone help me?  Thanks!
 
 
 
#2
0  
my messages.tbb start with
20 06 79 19 08 0C 00 00 00 00 00 00 00 00 00 00
followed by lots of 00 (version 3.85). There is no common end.
Not sure what this info can be used for. Do you want to somehow manually reconstruct them, like to append the end of current damaged file to a good copy retrieved from a disk image?
 
 
 
#3
0  
Yes I'd like to manually reconstruct from raw hard disk image.  (Stupid me).  Using "foremost", the headers are recognized so I can get a lot of files, but with a *lot* of extra junk (data) at the end.  I wonder, is there some kind of EOF for .TBB files?  Thanks ..
 
 
 
#4
0  
there doesn't seem to be a common EOF
All *.tbb's I checked end with 0x0D 0x0A (CR + LF) but everything before that is different for each .tbb

.tbb's just end with the last message in the folder, maybe even that CR+LF is a part of the last message, not sure

But if you have a hard disk image taken from a non-damaged drive, .tbb's inside should be OK and should not need any sort of reconstruction.
 
 
 
#5
0  
Hmm.  I guess I'll have to examine each TBB by hand. I'm running linux (using wine to run "the Bat", using linux file system to store .TBB files) - and find raw data appended to TBBs I get from "foremost".  It's going to be fun!   %^(

Thanks though.
 
 
 
Pages: 1