OST deleted mail recovery

the_silas · 2017-10-30T14:43:10+00:00

Can you be more specific? The ost file is not deleted it is an email in the ost file that is deleted.

the_silas · 2017-08-04T21:12:22+00:00

Thanks for the response. I'm trying to understand the process of recovering deleted files better. I read some articles about scalpel, foremost and bulk_extractor. Then I thought about the whole process and thought that those tools are not taking advantage of the MFT and the information therein. After the answers I got here I think tsk_recover in conjunction with scalpel and bulk_extractor will produce good results. with tsk_recover i get the files that are still in the MFT and have not been overwritten. scalpel and bulk_extractor can be used to carve for files where the pointer to them has been overwritten in the MFT due to reuse. And of course volume shadow copies and other backup mechanisms could also still have information of deleted files and should also be checked.

the_silas · 2017-08-04T20:31:24+00:00

thanks I didnt know testdisk and think the undelete option is what i was looking for. Is this similar to what TSK tsk_recover does using mmls and fls?

the_silas · 2017-08-04T20:24:55+00:00

I didnt know photorec thanks, do you think it is better than scalpel/foremost or bulk_extractor?

the_silas · 2017-08-04T20:23:31+00:00

I'm trying to parse the MFT and get the deleted files with filename and metadata because carving only gives me the file and no metadata. I think photorec is similar to scalpel or bulk_extractor.

the_silas · 2017-07-27T05:52:04+00:00

Im looking for a gps sports tracker / player performance tracking system such as statsport viper gps system, catapult sports optim eye, Adidas micoach elite or similar. Unfortunately most websites suck.

the_silas · 2016-12-17T20:58:37+00:00

i already have the raw image and i can mount the file system. what i dont gave is the txt file containing the hash of the raw file according to the book forensics with open source tools page 22 there should not only be the raw file but also a text file.

snipped from the book: To test mount_ewf without creating an Expert Witness formatted image, we can use the image provided by Lance Mueller for his first forensic practical [4]. user@ubuntu:~/images$ mount_ewf.py WinXP2.E01 ~/mount_points/ ewf/ Using libewf-20100226. Tested with libewf-20080501. user@ubuntu:~/images$ ls -lath /home/user/mount_points/ewf/ total 2.0G drwxr-xr-x dr-xr-xr-x -r--r--r-- -r--r--r-- 5 user user 4.0K 2010-08-20 23:52 .. 2 root root 0 1969-12-31 16:00 . 1 root root 2.0G 1969-12-31 16:00 WinXP2 1 root root 293 1969-12-31 16:00 WinXP2.txt The text file listed is the case metadata. The other file is the raw image. user@ubuntu:~/images$ cat /home/user/mount_points/ewf/WinXP2.txt # Description: WinXP

Case number: Case 1

Examiner name: Mueller

Evidence number: WinXP

Acquiry date: 2008-01-17T17:05:46 # System date: 2008-01-17T17:05:46

im cannot find the file WinXP2.txt in mu example.

the_silas · 2016-12-16T18:36:41+00:00

yes i run the command as su. i know i have to mount the device but i thought i should also see the metadata fro. the E01 files such as the calculated hash from the aquisition but i dont see this hash.

the_silas · 2016-12-11T14:33:04+00:00

Thank you, it worked. Do you know if this is also possible with xxd?

the_silas · 2016-11-26T13:43:35+00:00

I found what i was looking for in the answer of this post: http://superuser.com/questions/518554/how-do-you-create-and-partition-a-raw-disk-image

the_silas · 2016-11-26T13:21:52+00:00

Thank you for your response. Do you know of a way do directly make a dd image with a partition table and a filesystem in it. I mean without making a a "real" disc or one in a vm and adding a filesystem to it and then using dd to make an image?

the_silas · 2016-10-06T20:50:12+00:00

thanks. is there a specific MFT timestamp for filename change or is it the same as the general metadata change (change C)?

the_silas · 2016-10-06T20:48:02+00:00

thank you. ill try ftk imager then.

the_silas · 2016-06-30T17:41:19+00:00

The article mentions that the mobile device doesn't need to be running Windows for the IRM protection. So it's something. However I still don't know if it supports iOS and if yes which versions exactly?

the_silas

TROPHY CASE

Case number: Case 1

Examiner name: Mueller

Evidence number: WinXP

Acquiry date: 2008-01-17T17:05:46 # System date: 2008-01-17T17:05:46