Georgefan wrote:
the resulting information is mainly used for indicative findings.It seems that the email content in the fragment nsf file is compressed,so directly utilizing string search can not find what i am looking for.It is all about a hard drive of 200GB sizeI had a defence job many years back where the prosecution couldn't find some deleted received emails that our client had sent he had just forwarded - i.e. they had the forwarded/sent message but not the message he had received
The emails where in AOL PFC's and it seemed that the received emails were compressed but the sent/forwarded emails where not. It took a little effort to write a tool that could identify an AOL compression header and then search unallocated for the header and decompress the data to find the emails our client had received and forwarded.
As emails need to stand alone (i.e. each email is *likely* compressed as an individual item) I would expect that this approach could be utilised with nsf files (it's many many years since I have played with one of these though so I could be mistaken <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" />
↧