• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 167
  • Last Modified:

How to find an email or document in a PC using a specific unique piece of txt ? (using a hex editor)

Is there  away?
I thought I saw it being done once years ago.

In this case its an email.
0
fcek
Asked:
fcek
1 Solution
 
fcekAuthor Commented:
say for exampl I knew a document somewhere on the c drive contained the text

"123456789"

> is there a way to search the c: drive for this?

> is ther a way to search through a .pst file using a hex editor as well?
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
When you say is the Subject of the email as 123456789 or its a body content if so it might not be helpful as Windows search can only search for Words and not content in the files

- Rancy
0
 
Davis McCarnOwnerCommented:
As long as the PST is not encrypted, you can use a hex editor in sector mode to simply search the drive for as specifc and unique a string as possible. Searching for "john.brady@somecompanyinc.com" will find every E-Mail (to or from), his entry in most address books, any file containing his E-Mail address, and any temporary files created.
When you find an E-Mail, they can usually be read just like a telegram.
Older documents can also be found; but, newer unicode items may be much harder as every odd character will be 00 (i.e. j o h n . b r a d y @)
I have done forensics since 1979 and have used Winhex for the last ten years.  It does a great job of building a list of the strings you search for and then lets you step through the list to examine the hits.
0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Tackle projects and never again get stuck behind a technical roadblock.
Join Now