Hi Tech,
I have client who have send data to us for processing and they said they exported it using Encase where all the email data is converted into RTF format, meaning all i see is files called Body with no extension. Is there way to put them back into there actual file example PST or MSG.
If someone is familiar i can provide more details what exactly i am looking, I use FTK tool kit so I am not sure encase will do it. I won't mind buying Encase the only tool can do it. But before buying i wanted to make sure it will do thew job.
Thanks in advance.
Regards
Ajeet Tiwari
I don't know of a conversion tool that can do that. I would contact the client and ask if there is an OST or PST in the image and export that out. I do it in EnCase all the time.
It is possible that the user saved them as an RTF. If it is saved in the system as an RTF and not an OST or PST, you might be stuck.
It is hard to comment without seeing an example of one of these RTF files.
Does the RTF file contain the EMail headers records?
Did attachments to the EMails also get exported?
In the case where the Email had both a text and HTML version, did both get exported?
Did the folder path get exported with the RTF file?
I am guessing the answer to some or all of these questions is no. So conversion back into the original format will be impossible. Or if conversion is possible, there will be some data loss.
RTF to PST isn't a common operation. There might be no tools available to even do a lossy conversion.