Georgefan wrote:
Thanks for your reply so do you think there is any chance to recover a fragmented nsf file?Or is it possible to just extract email messages from the fragmented nsf file?
As a first stage I would look to see if there are any complete .NSF files on the disk, and see how fragmented they are. If they just have one or two fragments then manual repair 'just' be possible if you understand the file structure. If the files are in multiple fragments, forget it. To process fragmented files you need to understand the structure exceptionally well, and also be aware that similar files can lead to false positive matches - ie part of file 'a' with file 'b'.
My main attempt to solve your problem would be to see if the original MFT entry exists and still has it's data run info intact.
Finally I would run a keyword search to find sectors that contained e-mail info, eg phrases such as 'reply to:' Look at some good e-mails to see what standard headers they contain. You may be able to do some type of data carving but I suspect e-mails will start anywhere in a sector, and not just on cluster boundaries - most carving tools expect files to start on sector or cluster boundaries
↧