Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My laptop with SSD drive had a sudden power loss, and upon booting windows up again, an RTF file seems to have been corrupted as a result (despite the file being saved to disk just fine - the file WAS open in wordpad, but changes HAD been saved - so I wasn't expecting this) - the RTF file is now nothing but a page of squares.

It's an important file so I want to try to recover it. I can search unique text I know was in the file in the start menu, and it brings up the file in search results, even quoting text fragments from inside the file. So I want to try and extract that text that Windows Index clearly has there, and recover it that way.

I disabled 'Windows Search' service and then copied the entire C:\ProgramData\Microsoft\Search\Data\Applications\Windows folder including my 9GB Windows.edb file.

How would I best search and retrieve the text in question from my 9GB edb file? A professional forensic specialist mentions here that he does it, but doesn't mention his method.

Windows Grep, maybe? Is there any syntax I have to be careful of when searching for the text? Is there a particular tool?

Also if there's any other way you know of recovering a corrupt RTF like this where the text is all squares that would be a huge help.

Thank you

share|improve this question

1 Answer 1

Here is a paper that outlines how to do this. The author of the paper has a Google Code project dedicated to a tool called libesedb that will parse this file for you. Woanware also has a free tool (EseDbViewer). If you'd like a commercial tool, Passware has written a tool that does this as well. There are additional commercial tools available as well.

You could also try loading the RTF file in a hex editor and seeing if you can see any human-readable text as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.