fuzed Posted April 11, 2016 Report Share Posted April 11, 2016 I have a case where the client has found no hits in relation to an email address they were interested in using the Intella Connect platform. I've done a search for the email address and found numerous hits within the unallocated clusters. Now I need to get this material out of the unallocated and get it hosted on the platform somehow. Any thoughts on how I can go about parsing the unallocated from these emails? They all seem to be html content, which isn't going to help. I've got the data loaded within EnCase. Any help is appreciated. Link to comment Share on other sites More sharing options...
Andrej Posted April 11, 2016 Report Share Posted April 11, 2016 Hello fuzed, Intella attempts to recover deleted emails from the unallocated space in a PST file, however, Intella does NOT recover deleted files from disk images. Link to comment Share on other sites More sharing options...
fuzed Posted April 11, 2016 Author Report Share Posted April 11, 2016 Thank you, yes I understand that, however I was wondering if anyone had a process which would scan through the unallocated clusters area of a hard drive and parse data that might be email. Link to comment Share on other sites More sharing options...
AdamS Posted April 12, 2016 Report Share Posted April 12, 2016 You could try isolating and exporting the deleted emails with EnCase as PDF or some other document type, then index those new files with Intella to make them available. It's been a few years since I used EnCase so not sure on the process you could use, but I can tell you how to do it with Xways Link to comment Share on other sites More sharing options...
jon.pearse Posted April 12, 2016 Report Share Posted April 12, 2016 Fuzed, I think Adam is on the right track suggesting to use EnCase. I have not used the latest version of EnCase but earlier versions had a 'file finder' function. You may be able to search for the file signature of the message and carve the messages out that way. Regards Jon Link to comment Share on other sites More sharing options...
fuzed Posted April 12, 2016 Author Report Share Posted April 12, 2016 Thanks guys, I'll have to look into it and see if there is an easy way to parse the unallocated for mail. Link to comment Share on other sites More sharing options...
Recommended Posts