OLKMESSAGE14 and OL...
 
Notifications
Clear all

OLKMESSAGE14 and OLKMESSAGE15 Email files

4 Posts
3 Users
0 Likes
1,096 Views
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
Topic starter
 

Hello all,

Just wanted to report that Nuix's ProofFinder tool (www.prooffinder.com) was able to process and convert to PDF format .OLKMESSAGE14 and .OLKMESSAGE15 email files extracted from a MacBook

OLK MESSAGE files are individual email messages that Microsoft Outllook stores emails as on MacBooks.

I tried multiple other forensic tools (and Outlook 2016 and Mozilla Thunderbird) to present the OLK files in a format which could be reviewed by an attorney and only ProofFinder could properly process these email messages such that the headers and body were legible.

Hope this helps anyone else in the future grappling with this OLK format.

 
Posted : 09/10/2017 6:24 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Excellent news!

 
Posted : 11/10/2017 10:20 am
(@jasonlee)
Posts: 17
Active Member
 

I use emailchemy to convert the mac mail data to an mbox. One reason why it is needed is because the attachments are not associated to the email.

 
Posted : 11/10/2017 1:21 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
Topic starter
 

Interestingly, I also found an "outlook.sqlite" file on the MacBook.

Internet Evidence Finder could process the "outlook.sqlite" file and converted the file to 12,700 "emails" with varying amounts of recovered information (some records had metadata and others did not).

I have not checked but possibly the "outlook.sqlitedb" file has pointers to the OLKMessage files.

 
Posted : 12/10/2017 1:40 pm
Share: