Data Recovery and Disk Utilities Forum @R-TT

[quote]The mail are sent by the native Apple application "mail"[/quote]
I don't know that application, but for this to have any chance of working, each e-mail should be stored as an individual file.

[quote]By selecting all disk units / memory partitions, and after 2 days we see yet a remaining time of two months (but: we see in the recover files several .eml files, also really old, so, we are sure that this is the right direction).[/quote]
It may be the right direction, but it may be the right direction to a fool's errand. If the file was deleted, then overwritten, then it is not possible to recover it, period.

[quote]our customer needs to recover an old mail which could prove its innocence in a penal proceeding.[/quote]
Plus, you're not even sure if such a method of file retrieval would be considered legally acceptable.

[quote]By selecting all disk units / memory partitions, and after 2 days we see yet a remaining time of two months[/quote]
What exactly are the “disk units” and “memory partitions” in question ? What does the SMART tab say about each one of them ? You shouldn't run a recovery attempt this way if there's the slightest hint of a physical malfunction, which would translate as SMART warnings.

[quote]If I try a recover on the entire disk, the waiting time is more than 2 months. So, I ask if it is possible to specify some parameter / time constraint / or (why not) a specific folder where usually the Mail app store all mail, in order to make short this time.[/quote]
Indeed it is absolutely not normal for the scan of any drive of current capacity to last that long, it shouldn't take more than 4 hours per TB of storage space (which corresponds to an average scanning speed of 70MB per second).

[quote]If I try a recover on the entire disk, the waiting time is more than 2 months. So, I ask if it is possible to specify some parameter / time constraint / or (why not) a specific folder where usually the Mail app store all mail, in order to make short this time.[/quote]
If the e-mail application stores e-mails as plain text, and if the client precisely remembers a specific enough part of that e-mail's content (a single word is not enough, it should be a rather rare expression, or a peculiar misspelling, and preferably somehting with no special characters like diacritics, which can be coded in different ways), then it's possible to run a “raw” search with that that specific key-word, and then when there's a hit, extract the complete file, by comparing the begining and the end with a known valid e-mail file. This can be done with a hexadecimal editor like WinHex (normally this could be done with the freeware HxD but I just tested, I can't find how to export a selected block as-is, with no extra formatting like RTF or HTML or whatnot ; WinHex has a very useful “simultaneous search” feature, which allows to search several keywords at once, and to search them all in several text encoding schemes, in case you don't know which one was actually used -- if you open a valid e-mail file generated by that same application with an advanced text editor like Notepad2 or TedNotepad it should tell you what specific encoding is used, like Unicode or UTF-8 or ANSI).

[quote=Archimede post_id=17360 time=1630664461 user_id=5411]
The mentioned function doesn't work for me because the filter you suggested is active after the data recover. In a large amount of data already recovered, by this function I can select the desired files.

I need something totally different: at the beginning, before the recover phase, I need to specify which kind of data I am searching for.
[/quote]

That doesn't matter. You can't tell which data is which until you've parse all the data on the disk.

[quote=Archimede post_id=17360 time=1630664461 user_id=5411]
In other words:

The purpose is:
[b]On a Mac Boox 2013, I need to recover a couple of email sent by native "mail" application in the 2016 year.[/b]

The problem is:
If I try a recover on the entire disk, the waiting time is more than 2 months. So, I ask if it is possible to specify some parameter / time constraint / or (why not) a specific folder where usually the Mail app store all mail, in order to make short this time.
[/quote]

There's something wrong with the overall process. When do you get the info about 2 months? When R-Studio enumerates files after you've opened the disk? If yes, wait for a while, it won't last for 2 months, that's just estimation on a rather damaged file system.

The mentioned function doesn't work for me because the filter you suggested is active after the data recover. In a large amount of data already recovered, by this function I can select the desired files.

I need something totally different: at the beginning, before the recover phase, I need to specify which kind of data I am searching for.

In other words:

The purpose is:
[b]On a Mac Boox 2013, I need to recover a couple of email sent by native "mail" application in the 2016 year.[/b]

The problem is:
If I try a recover on the entire disk, the waiting time is more than 2 months. So, I ask if it is possible to specify some parameter / time constraint / or (why not) a specific folder where usually the Mail app store all mail, in order to make short this time.

I ask you an help, is a really urgent staff. Thank in advance, in case I can share with you all needed data, including screenshot. Thanks really again.

[quote=Archimede post_id=17349 time=1630600837 user_id=5411]
EDIT: Would also be enough a filter, something like "recover only the file .eml and between the years 2018 and 2019". But we haven't found the way to do it. Thanks again.
[/quote]
[url=https://www.r-studio.com/Unformat_Help/findafile.html]Searching for a File[/url].

Dear users,
our customer needs to recover an old mail which could prove its innocence in a penal proceeding.

The computer is Mac Book 2013
Operating system OSX
The mail are sent by the native Apple application "mail"

We tried to recover it in two ways:

1) By selecting only the folder with the red cross (in this case the process end in few minutes, but we haven't recover what we need;
2) By selecting all disk units / memory partitions, and after 2 days we see yet a remaining time of two months (but: we see in the recover files several .eml files, also really old, so, we are sure that this is the right direction).

We are sure that this recover is possible (we already recover in this way also mail about 2016 year!), but the time is too long. How can we do a shorter search, or, it is the way to filter the desired data?

If someone needs, I can send in this forum also the screenshots of the recover operations / selections so someone can say if we are trying it correctly or if we are searching in a too large space.

Thank REALLY for your helping and for your time, is really urgent. And we have not recovery center (i.e. white room and something like that) in the near.

EDIT: Would also be enough a filter, something like "recover only the file .eml and between the years 2018 and 2019". But we haven't found the way to do it. Thanks again.