Carving deleted messages from PST file remains

Dear all,

I'm investigating a case in which deleted e-mail messages play a 
significant role. The suspect has deleted his e-mails from within 
Outlook, so that the size of the PST file has shrunk from hundreds of 
megabytes to hundreds of kilobytes. The deleted messages are still on 
the hard drive, but "outside" the PST file. This means that the 
messages can be accessed, but not in easily readable format.

I'm looking for a way to use the file carving method to restore 
individual e-mail messages. The idea is to locate the messages using a 
variation of file carving, and then trying to create a working PST file 
from the individual messages.

Another idea that has crossed my mind is extracting the free space of 
the hard drive in question into files, and then running these files 
through a PST file recovery program. Preliminary tests suggest that 
this may actually work.

If anyone is aware of a standard delimiter or message header in the PST 
file, used to mark the beginning of a new message (or other Outlook 
item), I would be happy to hear all the details.

All other comments are also welcome.

Yours,

Jyri Hovila

IT Security Specialist
Turvamies IT Security Services
www.turvamies.fi


#####################################################
This message has been checked for viruses and spam.
www.turvamies.fi info@turvamies.fi
#####################################################