In the case that Im concerned with, Im in urgent need of a way to recover old AIM conversation. The file that I need, I have found in the C/program_files/AIM+/AIM+_History/Username/2005-12-28_[Wednesday] When this file is opened nothing but a blank document comes up. Its size is 108 Bytes. I dont know if there is any way to recover this and find the conversation itself, it has the time and date recorded and in the past Ive seen conversations recorded. Im not sure if the version of AIM matter, maybe so but I just really need this conversation. Its my brother that needs it by tonight, his lawyer says that this document could do some great help on the case tomorrow morning. Its short timing but Ive just been looking for all the help I can get. Thanks for any help you can do.
"When this file is opened nothing but a blank document comes up"
How are you trying to open it? Are you using Notepad? If so, have you thought of using a hex editor? Many times, a file containing binary data will appear as if it's empty, as the binary information doesn't contain what your text editor understands as printable characters.
"I dont know if there is any way to recover this and find the conversation itself,.."
At 108 bytes, it can't be much of a conversation. 😉
"Im not sure if the version of AIM matter[sic]…"
Perhaps. Modern versions of AIM don't log conversations by default…you need third party add-ons like DeadAIM to do that.
Harlan
Hi friend
I hate to be the bearer or bad news but the very fact that you are trying to recover this for your brother could well have already prevented any evidence being legally admissible
Any computer evidence needs to have been recovered in a manner that would prevent any changes being made from the moment it left the owners custody and you would need to demonstrate this in a forensically sound manner. If you have been searching his machine then anything you recover could have been edited and hence is not sound.
On your technical question the fact that the file is only 108 bytes shows that it is essentially empty. Forensic software such as Encase, FTK or free software such as ProDiscover or X-Ways may help you to recover some deleted data but please bear in mind that this is possibly all for nothing if you have not been working under forensic conditions up to now.
If this is a critical then I strongly suggest you turn off the PC and document the time then contact a forensic expert for assistance. Your lawyer should understand these issues and may have someone on their books
Nick
Thanks for the help. I figured it may have been nothing at all but that blank document but we were all hoping that there might be a way to do something. Thanks again