looking for lost data in unallocated space on NTFS

clabrown · 2009-12-12T04:40:31Z

I recently lost some email in Thunderbird Inbox and would like to scan unused clusters in NTFS (WinXP) looking for email Message Headers to see if I can find any of the lost messages. Some kind of forensic scanning tool, or perhaps write my own simple tool if I can figure out how to access the NTFS at a low enough level, find what clusters are unused and scan each one. Any suggestions?What happened is that the laptop crashed, and next start up it did a scan disk. I didn't notice the problem right away, but next time I opened Thunderbird it created a new blank Inbox. It wasn't just a problem with the inbox index, I checked the inbox file size and it was a few hundred K instead of over a GIG. I think the scan disk must have deleted the original inbox, or somehow truncated it. Standard undelete programs don't find a deleted Inbox file, so I'm guessing that the File's directory entry must have been reused.I'm sure the email data is still on the disk in the unused clusters. I stopped using the disk, cloned the system to a new disk and set the original aside. I have managed to recover most of the Inbox from a somewhat dated backup (my bad) and import a few chunks from another client that I had checked email with a few times, so it's not the end of the world.

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by deerhunter 16 years ago

11 Posts

7 Users

0 Reactions

3,372 Views

RSS

deerhunter

(@deerhunter)

Active Member

Joined: 17 years ago

Posts: 15

14/12/2009 2:12 am

Do you understand Linux? Can you run VMWare Player? If so, download the SANS SIFT VM workstation at
https://computer-forensics2.sans.org/community/downloads/

This tool sounded interesting so I tried to download it myself from the SANS website. When I tried to set up an account with SANS it asks for my billing information. Before I unknowingly comit my department to paying for an account, is this a pay site and how much?

ReplyQuote

Page 2 / 2 Prev

Podcast: Well-Being In Digital Forensics And Policing: Insights From Hannah Bailey

Hannah Bailey shares her journey from frontline policin...

By Zoe , 5 days ago
RE: Android Forensics

Hi, Try decompressing the file using zlib in python. ...

By Dexter4n6 , 5 days ago
Interview: Neal Ysart, Co-Founder, The Coalition of Cyber Investigators

Neal Ysart shares how The Coalition of Cyber Investigat...

By Zoe , 6 days ago

8 Forums
15.7 K Topics
92.3 K Posts
4 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed