Although I don't have an answer to your specific question, i do have a comment.
The WinHex program (forensic edition) does a good job of regognizing and
presenting
to you in a preview mode, the content of PST files. The technology WinHex uses
is
based on the Outside In Viewer Technology.
Would it be possible to switch between the preview mode and hex display to
determine
common patterns of hex values that make up the individual email messages?
slawek
-----Original Message-----
From: Jyri Hovila <jyri.hovila@turvamies.fi>
Sent: Jun 13, 2005 2:51 PM
To: forensics@securityfocus.com
Subject: Carving deleted messages from PST file remains
Dear all,
I'm investigating a case in which deleted e-mail messages play a
significant role. The suspect has deleted his e-mails from within
Outlook, so that the size of the PST file has shrunk from hundreds of
megabytes to hundreds of kilobytes. The deleted messages are still on
the hard drive, but "outside" the PST file. This means that the
messages can be accessed, but not in easily readable format.
I'm looking for a way to use the file carving method to restore
individual e-mail messages. The idea is to locate the messages using a
variation of file carving, and then trying to create a working PST file
from the individual messages.
Another idea that has crossed my mind is extracting the free space of
the hard drive in question into files, and then running these files
through a PST file recovery program. Preliminary tests suggest that
this may actually work.
If anyone is aware of a standard delimiter or message header in the PST
file, used to mark the beginning of a new message (or other Outlook
item), I would be happy to hear all the details.
All other comments are also welcome.
Yours,
Jyri Hovila
IT Security Specialist
Turvamies IT Security Services
www.turvamies.fi
#####################################################
This message has been checked for viruses and spam.
www.turvamies.fi info@turvamies.fi
#####################################################
________________________________________
PeoplePC Online
A better way to Internet
http://www.peoplepc.com
