Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop with SSD drive had a sudden power loss, and upon booting windows up again, an RTF file seems to have been corrupted as a result (despite the file being saved to disk just fine - the file WAS open in wordpad, but changes HAD been saved - so I wasn't expecting this) - the RTF file is now nothing but a page of squares.

It's an important file so I want to try to recover it. I can search unique text I know was in the file in the start menu, and it brings up the file in search results, even quoting text fragments from inside the file. So I want to try and extract that text that Windows Index clearly has there, and recover it that way.

I disabled 'Windows Search' service and then copied the entire C:\ProgramData\Microsoft\Search\Data\Applications\Windows folder including my 9GB Windows.edb file.

How would I best search and retrieve the text in question from my 9GB edb file? A professional forensic specialist mentions here that he does it, but doesn't mention his method.

Windows Grep, maybe? Is there any syntax I have to be careful of when searching for the text? Is there a particular tool?

Also if there's any other way you know of recovering a corrupt RTF like this where the text is all squares that would be a huge help.

Thank you

share|improve this question

Here is a paper that outlines how to do this. The author of the paper has a Google Code project dedicated to a tool called libesedb that will parse this file for you. Woanware also has a free tool (EseDbViewer). If you'd like a commercial tool, Passware has written a tool that does this as well. There are additional commercial tools available as well.

You could also try loading the RTF file in a hex editor and seeing if you can see any human-readable text as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.