joachimm wrote:
>
Really depends of various factors:
* what are you after?
* how is the resulting information going to be used as indicative findings or evidence?
* how much data do you have?
* how much effort is it worth?
* what is the skill level of the person doing the recovery?
I agree with mscotgrove here that try the low hanging fruit first, e.g. is a string search sufficient to find the evidence you seek, e.g. icw. searching through compressed data (e.g. bulkextractor)? Is there a backup notes/domino has this nice feature that it replicates files on the server (in some cases), VSS? etc, etc.
the resulting information is mainly used for indicative findings.It seems that the email content in the fragment nsf file is compressed,so directly utilizing string search can not find what i am looking for.It is all about a hard drive of 200GB size
↧