Unallocated Mail

[fuzed]

I have a case where the client has found no hits in relation to an email address they were interested in using the Intella Connect platform.

 

I've done a search for the email address and found numerous hits within the unallocated clusters.

 

Now I need to get this material out of the unallocated and get it hosted on the platform somehow.

 

Any thoughts on how I can go about parsing the unallocated from these emails?  They all seem to be html content, which isn't going to help.

 

I've got the data loaded within EnCase.

 

Any help is appreciated.

[Andrej]

Hello fuzed,

 

Intella attempts to recover deleted emails from the unallocated space in a PST file, however, Intella does NOT recover deleted files from disk images.

[fuzed]

Thank you, yes I understand that, however I was wondering if anyone had a process which would scan through the unallocated clusters area of a hard drive and parse data that might be email.

[AdamS]

You could try isolating and exporting the deleted emails with EnCase as PDF or some other document type, then index those new files with Intella to make them available.

 

It's been a few years since I used EnCase so not sure on the process you could use, but I can tell you how to do it with Xways

[jon.pearse]

Fuzed,

 

I think Adam is on the right track suggesting to use EnCase. I have not used the latest version of EnCase but earlier versions had a 'file finder' function. You may be able to search for the file signature of the message and carve the messages out that way.

 

Regards

 

Jon

[fuzed]

Thanks guys, I'll have to look into it and see if there is an easy way to parse the unallocated for mail.