No announcement yet.

Corrupt Case Item

  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    Just an update on this issue (I've also replied back via e-mail).

    We have received the files and investigated the two issues at hand here.

    First, we can confirm that not all of the fields in the headers of email messages in PST files are being indexed. In this case, it was an email address in the "Return-Path:" field that was not being found. You can view the headers in the e-mail viewer, but they are being omitted from the index. We plan to add handling for this in the next version.

    Second, in regards to indexing e-mail addresses from unallocated clusters, this is working fine but you must enable "Extreme" binary extraction mode (under "Step 2" of Create Index, click the "Advanced options" button and change the "Binary String Extraction Level" dropdown). Once you have created an index with this enabled, you should be able to search for email addresses within unallocated clusters with queries such as:

    ... etc.

    We are planning to change the behaviour of this in future releases. Perhaps giving priority to patterns which resemble email addresses, phone numbers, etc. without needing to specify "extreme" extraction.
    PassMark Software


    • #17
      Thanks Ray.

      I am appreceating your work and hope the header problem will be fixed soon.

      Concerning the email addresses in unallocated space. I have created several indexes. It seems OSF does identify some email-address strings. But it is not clear for me, when it does and when it does not. Do you provide any documentation of the indexing function.

      btw, is it possible to sort forum posts descending?