When you say Outlook emails do you mean .pst files? Just image the CD with Encase or FTK if you have it.
In Encase, add the CD .e01 file and you will see what appears to be two copies of the same CD. That is because Encase will see both the formats the CD is written in. UDF and ISO. (If that is the case anyway.)
Once you have it in Encase, just locate the .pst file, right click on it and select View File Structure. That will bring up all the emails in Encase so you can view them in the explorer pane and bookmark them as needed.
The files are a .nws extension from ms outlook newsgroups. I have tried imaging the cds in Encase and it freezes everytime.
That is often an indication that the CD contains bad sectors: I think EnCase lets the CD drive do its own thing when it hits a bad sector (on my CD, it means up to 100 read attempts before it gives up). Then I supect EnCase tries one or two time more, just for safety. That obviously takes more time than it needs, and it very much looks as if Encase has frozen. (Checking the byte I/O for the process helps a bit in understanding what's going on)
If you have CloneCD from Slysoft, use that instead: it does the right thing for bad sectors -- gives up on bad sectors reasonably quickly. And you can configure it far more than Encase: you can create a 'forensic' profile to fit your own needs (added: as regards number of rewrites and how many sectors to skip after hitting a bad sector). Also recent versions of EnCase can read the image files produced by CloneCD.
I think there is a demo version of it to try out.
CD/DVD inspector should not hit those kind of problems, though -- I would be surprised if it did.
Last edited by athulin on Thu Nov 27, 2008 5:20 pm; edited 1 time in total
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum