Microsoft Outlook Express Email Messages

This Professional Recovery Module has the ability to recover live and deleted email messages (including attachments) whether directly from a Forensic image (such as an Encase^® e01 compressed image) or a physical disk / volume.  The output from the software allows the forensic investigator to identify the exact location the data was recovered from. 

The carving engine for this Module (and the AOL Professional Recovery Module) is the result of numerous years research and development.  It was originally released in the Digital Detective product EMLXtract.  This product has been used by law enforcement agencies all round the world to recover deleted Outlook Express data since 2004.

AOL (Personal Filing Cabinet) Email Messages

This Professional Recovery Module has the ability of recovering live and deleted email messages (including attachments) whether directly from a Forensic image (such as an Encase^® e01 compressed image) or a physical disk / volume.  The output from the software allows the forensic investigator to identify the exact location the data was recovered from. 

The carving engine for this Module is the result of numerous years research and development.  It was originally released in the Digital Detective product EMLXtract.  When this software was released to law enforcement in 2004, it was the first tool to recover AOL email messages from an image or physical/logical device.  When compared against other tools, this software recovered more email messages than any other.  It works particularly well against corrupted data when many other tools fail to recover anything at all.

Microsoft Windows Link File Recovery & Deconstruction

This Professional Recovery Module not only recovers live and deleted data from a number of different sources, it deconstructs the link file and writes the recovered information out to a number of different formats:

• CSV

• Excel Specific CSV (for easy opening in Microsoft Excel)

• XML

• SQLite Database

Each recovered record allows the forensic investigator to identify the exact location the data was recovered from.  This module supports Unicode characters.

E01 Image Converter

This Professional Recovery Module is FREE with the purchase of any other professional module.  The E01 Image Converter will take any Expert Witness source image and convert it into a single or segmented flat file image.  The module also has the option to MD5/SHA1 the output and compare it with the hashes embedded within the original image file.