FOSS tools for reading COM/OLE structured storage files

Larry Cook lcook at sybase.com
Wed Aug 6 11:03:22 EDT 2008


Ben Scott wrote:
> http://wiki.gnhlug.org/twiki2/bin/view/Www/DigitalForensicFileCarving

VirginSnow at vfemail.net wrote:
> IIRC, their toolkit (FOSS, of course) contained a tool for parsing 
> OLE Word documents.

Thanks Ben and VirginSnow!  I'll take a look at it.

Thomas Charron wrote:
> What's the *data* stored inside?  As far as a corrupted drive, if the
>  files where corrupted..

I think the filesystem got corrupted.  Scandisk reset the file size and 
therefore left lots of file fragments.

The *data* is a Juno 4 email folder.  The strings command is letting me 
get the text.  Unfortunately they stored the email headers and body 
separately and some genius thought to save the body first and then the 
header.  At least I can search for the text of individual emails while I 
investigate the possibility of putting the file back together.

> Well, good luck with that.  :-D

Thanks!

Larry




More information about the gnhlug-discuss mailing list