Re: [sleuthkit-users] Hard disk

[Derrick K. <dk...@gm...>]

Hello.

If it is email addresses you are looking for you could use
`bulk_extractor' (http://afflib.org) against the raw image which will
give you the offsets in the image where the email addresses are
located.

Derrick


On Wed, Aug 31, 2011 at 11:56 AM, Al Grant <big...@gm...> wrote:
> Hello,
>
> Recently I had a laptop that I had to identify the owner.
>
> The hard disk had been formatted and after imaging with ddrescue, I started
> to recover deleted data from the hard disk.
>
> I got various text files and photos that were particularly useful. Then
> using regexp I looked for strings matching email addresses (.com .co.nz,
> .com.au etc)
>
> I found a email address of the owner and job done.
>
> My question is, is there a better way?
>
> Regards,
>
> -Al
>
>
> ------------------------------------------------------------------------------
> Special Offer -- Download ArcSight Logger for FREE!
> Finally, a world-class log management solution at an even better
> price-free! And you'll get a free "Love Thy Logs" t-shirt when you
> download Logger. Secure your free ArcSight Logger TODAY!
> http://p.sf.net/sfu/arcsisghtdev2dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>