Analysing orion's backup file
Do you only have access to NCM?I would have thought querying the events log in NPM would be a better approach to find when something was disconnected? Personally I can't see how analysing backup data [which is typically just plain text] will show you when something happened.