Method and device for recovering email data

Abstract

The invention discloses a method for recovering email data, which comprises the steps of: loading an email key feature information database comprising email structure feature information and document head feature information of an email attachment; scanning matched information in a disc according to the key feature information in the email key feature information database; if the disc includes information matched with the key feature information, recording the offset of the storage position of the information in the disc; positioning the data in a corresponding disc position according to the storage position offset information; analyzing the coded email information from the data according to email structure features; carrying out fragment reorganization on the coded email information according to email coding features; and decoding the coded email information according to the email coding features, and outputting related email information.

Description

technical field [0001] The invention relates to the field of computer forensics, in particular to a method and device for recovering email data. Background technique [0002] Email was invented in the 1970s and took off in the 1980s. The silence in the 1970s was mainly due to the fact that too few people used the Arpanet network at that time, and the speed of the network was only one-twentieth of the current standard speed of 56Kbps. Limited by the speed of the network, users at that time could only send some short messages, and don't imagine sending a large number of photos like now; by the mid-1980s, with the rise of personal computers, e-mail began to spread widely among computer fans and college students; Since the mid-1990s, Internet browsers have been born, the number of Internet users around the world has surged, and e-mail has been widely used. It has become an important communication tool for human daily work and emotional communication. [0003] With the popular...

AI Technical Summary

Problems solved by technology

[0006] 1. There is a lack of recovery software for email data recovery. At present, various data recovery software (such as Easy Recovery, FinalData) around the world cannot recover the fragmented content of email text or email attachments.

[0007] 2. The recovery ability of data recovery software is limited

The e-mail structure is relatively complete, and some software (such as WinHex, EnCase) can customize the file signature, such as the characteristic key feature information "From:" in the e-mail header to achieve a certain degree of e-mail data recovery, but the e-mail is usually not relatively fixed Therefore, this method of email recovery can only be recovered according to the length of the set recovery data. Usually, the recovered email content is incomplete or contains a lot of other irrelevant data, so the effect is not satisfactory. , requiring more manual follow-up processing

[0008] 3. There are certain flaws in data recovery. Usually, discontinuous e-mail fragment data is not analyzed and processed.

Fourth, at present, there is no method or tool for automatic and intelligent recovery of e-mail fragment data that has been incomplete and only has attachments.

Images