Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop with SSD drive had a sudden power loss, and upon booting windows up again, an RTF file seems to have been corrupted as a result (despite the file being saved to disk just fine - the file WAS open in wordpad, but changes HAD been saved - so I wasn't expecting this) - the RTF file is now nothing but a page of squares.

It's an important file so I want to try to recover it. I can search unique text I know was in the file in the start menu, and it brings up the file in search results, even quoting text fragments from inside the file. So I want to try and extract that text that Windows Index clearly has there, and recover it that way.

I disabled 'Windows Search' service and then copied the entire C:\ProgramData\Microsoft\Search\Data\Applications\Windows folder including my 9GB Windows.edb file.

How would I best search and retrieve the text in question from my 9GB edb file? A professional forensic specialist mentions here that he does it, but doesn't mention his method.

Windows Grep, maybe? Is there any syntax I have to be careful of when searching for the text? Is there a particular tool?

Also if there's any other way you know of recovering a corrupt RTF like this where the text is all squares that would be a huge help.

Thank you

share|improve this question
    
How important is this file? The file, or fragments, may be somewhere else on your hard drive. Unfortunately, the location may be space that your operating system considers "free space", so your chances of overwriting may be quite likely. If it's important enough, make a Forensic image. (The sooner, the better... a single write to the wrong spot in the disk may destroy a recovery option.) Windows FIND is likely to be nearly as useful as grep. (grep has more power/flexibility, but a simple search will likely do just as well for you.) Maybe TestDisk – TOOGAM Jun 10 at 21:54

Here is a paper that outlines how to do this. The author of the paper has a Google Code project dedicated to a tool called libesedb that will parse this file for you. Woanware also has a free tool (EseDbViewer). If you'd like a commercial tool, Passware has written a tool that does this as well. There are additional commercial tools available as well.

You could also try loading the RTF file in a hex editor and seeing if you can see any human-readable text as well.

share|improve this answer

You must log in to answer this question.