I have a case where I have had to restore 10 SLT backup tapes containing MS Exchange 5.5 EDB files. The files are all about 15GB. I need to extract the emails from these, Paraben Network Email Examiner, Encase 6.2, FTK nor some of the other commercial products wont look at them. Network Email examiner says they are corrupted, the commercial products like Stella Phoenix claim there is no data with in the files. Raw text can be seen within the files and given there size there is data in them.
Anybody have any recommendation.
Please advise.
Either clean them with eseutil or try EnCase 6.11+ It has a "mount dirty" featur
The corruption is probably normal and due to the difference between the EDB file and the transactions that took place during the backup. As _nik_ mentioned, you can correct the situation with the eseutil program.
I recommend NEMX over Encase, but they'll both do the job. NEMX will identify deleted emails - Encase won't. Encase will retrieve the deleted emails; it just won't identify them as such. This may not be important to you, but if it is; NEMX is the way to go. I think the Encase version that mounts dirty EDB's is 6.12 - but I could be wrong.
Thanks for that, I tried Encase 6.2 previously on them, but Encase will only look at versions after Exchange 5.5. NEMX, says it is corrupted so I will try eseutil applcation and see if that works and then retry NENX.