Extracting email addresses

This tool might be of use http//www.forensicswiki.org/wiki/Bulk_extractor

I don't really see the point in only using a tool like WinHex nor "bulk_extractor" for this type of task as only a small minority of E-mail addresses will be visible in a hex dump of the disk.

The majority of E-mail addresses will be inside structured files. Like .PST files, DOCX, XLSX files. For all these files types the data will be compressed, or compressed and encrypted. So you'll get nothing from a hex dump. Even the ones that aren't compressed might be in a different character set (e.g. double byte Unicode), so you'll miss these as well.

I second the notion that it is not a really good way to collect those e-mails.

If you insist because of some esoteric requirement, Agent Ransack by MythicSoft allows you to do a very good search with a lot of options. It is also for the excellent price of $0.

Additionally, it is compatible with IFilters allowing to look into several non-text based file formats, resolving some of the issues previously mentioned.

@ Passmark & jhup

Yes and no.
It depands on the state of the disk and expectations.
Let's imagine and it is just an exmple, many important files (pst,eml,etc.) have been wiped and all you have got is slack and all free spaces of the disk. So there is no choice and such tool gotta be used.

@ AlexC
Thanx a lot. Although this tool has lack of some features, definitely its carving engine works very good.
)

When you write "wiped", do you mean wiped as in over-written, or wiped as in simply deleted from through the OS?

If the later then I would carve the files, and their remnants. Thereafter I would still need to use some other solution to interpret and extract e-mails from them.

Simple example - ZIP file with several mbox files. The ZIP file was recovered completely, by carving it.
Would searching the ZIP file reveal the e-mail addresses within the mbox files? Of course not. We need something to first interpret it (in our case something to open and extract the ZIP file content), thereafter search the results.
Other examples - what if it was a PDF file, a docx, xlsx? Your chances of finding e-mails by raw ASCII search is slim.

The referenced "bulk_extractor" can do some of the compressed files, but ultimately it is still the same principle.

It is like asking if yelling louder in a French restaurant in English will get you the right soup…

Sure it doesn't find everything like inside mentioned zip and similar.
But it gives a possiblity to find something in another places.
So it has been worth to use it as it is better to find something then nothnig.
As in my case, an access to the wiped archives (over written) was not possible.

Before jumping to a conclusion about what a tool does or does not do, it might be a good idea to actually take a look at it. I've heard bulk_extractor discussed by the author at OSDFC for the passed two years, and in each case, he has assured everyone that it is capable of going at least one level down into files that are not simply straight text (ASCII or Unicode).

The caveat to that is that it does a very good job of finding email addresses and apparently from his testing, he's found that MS employees like to put email addresses in their products. 😉

Try this mail extractor (full disk scan)

http//vidarvestnes.blogspot.no/2013/04/php-mail-extractor-v10.html

X-Ways forensics will do it very easily

add evidence, Refine volume snapshot, then do a simultaneous search using a regular expression for email addresses.

done.