Jump to content

Unallocated Mail


fuzed

Recommended Posts

I have a case where the client has found no hits in relation to an email address they were interested in using the Intella Connect platform.

 

I've done a search for the email address and found numerous hits within the unallocated clusters.

 

Now I need to get this material out of the unallocated and get it hosted on the platform somehow.

 

Any thoughts on how I can go about parsing the unallocated from these emails?  They all seem to be html content, which isn't going to help.

 

I've got the data loaded within EnCase.

 

Any help is appreciated.

Link to comment
Share on other sites

You could try isolating and exporting the deleted emails with EnCase as PDF or some other document type, then index those new files with Intella to make them available.

 

It's been a few years since I used EnCase so not sure on the process you could use, but I can tell you how to do it with Xways :)

Link to comment
Share on other sites

Fuzed,

 

I think Adam is on the right track suggesting to use EnCase. I have not used the latest version of EnCase but earlier versions had a 'file finder' function. You may be able to search for the file signature of the message and carve the messages out that way.

 

Regards

 

Jon

Link to comment
Share on other sites

×
×
  • Create New...