philrodo Posted December 16, 2015 Report Share Posted December 16, 2015 I have recovered via file carving from an HSF+ volume, a large number of olk14message and olk14msgsource files (emails from Outlook or Entourage for the MAC). Can Intella process and index these? Please let me know. Link to comment Share on other sites More sharing options...
AdamS Posted December 16, 2015 Report Share Posted December 16, 2015 Hey Phil, as luck would have it I just finished a job on a Mac image with almost exactly that situation. Intella did process the individual olk14 emails, however without the entourage database file being processed/converted there were no attachments or folder structure. I found (and purchased) a tool called 'Emailchemy' for $30 which converted the entourage database file, which I then processed with Intella, all attachments and folder structure intact. Fantastic little tool, couldn't recommend it highly enough! Below link has some info on where to find the database file which needs to be converted. http://www.office.mvps.org/path/index.html Link to comment Share on other sites More sharing options...
philrodo Posted December 16, 2015 Author Report Share Posted December 16, 2015 Adam Thanks for the feedback. I'm familiar with Emailchemy, a tool I used to use more than 10 years ago, but I haven't had the occasion or need to use recently. I didn't realize that it now handles entourage databases, though.... My predicament is a bit different. I"m not dealing with the database. Everything was deleted on the MacBook. However, X-Ways recovered a bunch of files via file carving out of UA. In addition to the EML/EMLx files, it also recovered a bunch of olk14message, olk14msgsource, and olk14attachments files. My understanding is that the mlk14message are the message headers and the olk14msgsource are the actual messages. The X-Ways viewer displays the full olk14msgsource files in email format. My question is whether I can dump all the olk14* files into Intella and whether Intella can recognize and process them. If anyone knows the answer to this question, please let me know. Thanks. Link to comment Share on other sites More sharing options...
AdamS Posted December 17, 2015 Report Share Posted December 17, 2015 Morning Phil, I had some recovered olk14 data from my case so I indexed that in Intella and it doesn't appear to recognise or deal with that format. They were all indexed as 'unknown binary files' and nothing was really presenting properly. Might have to just process via Xways in this instance and use it's own search/index capability. Link to comment Share on other sites More sharing options...
philrodo Posted December 17, 2015 Author Report Share Posted December 17, 2015 Thanks for the feedback, Adam. X-Ways is a GREAT tool, but I shy away from using it to process emails. But in this case I guess I have no choice, which means I'm going to end up having to process the EML/EMLX files in X-Ways too, to be consistent. Best regards, Phil Link to comment Share on other sites More sharing options...
AdamS Posted December 17, 2015 Report Share Posted December 17, 2015 I'm the same Phil, love Xways but not a fan of how it handles emails Link to comment Share on other sites More sharing options...
Recommended Posts