If the email account was on an Exchange server, you can likely retrieve
these from server backups. Sometimes, it is possible to retrieve deleted
emails messages from the .PST file, if the .PST file has not been compacted,
by intentionally corrupting the file index and then using the Microsoft
Scanpst utility to rebuild the file. Only try that technique with a backup
copy of the .PST file since success is not assured and you may make the file
unreadable. In your case, the decreased file size suggests that the file
was compacted after the email was deleted. I have not found an easy way to
reconstruct a .PST file with saved email. You may be able to manually
rebuild it with Microsoft Access, but I don't see a benefit. Two good
utilities for searching email that aren't in a .PST file are X1
http://www.x1.com/ and the Copernic Desktop Search http://www.copernic.com/
. Both programs will index all the files on a hard drive and permit easy
retrieval.
I did a white-paper on retrieval of Outlook email for my office. I will see
if I still have a copy.
Kent Shaw,CPA,CCP,A+,Network+,Security+
-----Original Message-----
From: Jyri Hovila [mailto:jyri.hovila@turvamies.fi]
Sent: Monday, June 13, 2005 3:51 PM
To: forensics@securityfocus.com
Subject: Carving deleted messages from PST file remains
Dear all,
I'm investigating a case in which deleted e-mail messages play a
significant role. The suspect has deleted his e-mails from within
Outlook, so that the size of the PST file has shrunk from hundreds of
megabytes to hundreds of kilobytes. The deleted messages are still on
the hard drive, but "outside" the PST file. This means that the
messages can be accessed, but not in easily readable format.
I'm looking for a way to use the file carving method to restore
individual e-mail messages. The idea is to locate the messages using a
variation of file carving, and then trying to create a working PST file
from the individual messages.
Another idea that has crossed my mind is extracting the free space of
the hard drive in question into files, and then running these files
through a PST file recovery program. Preliminary tests suggest that
this may actually work.
If anyone is aware of a standard delimiter or message header in the PST
file, used to mark the beginning of a new message (or other Outlook
item), I would be happy to hear all the details.
All other comments are also welcome.
Yours,
Jyri Hovila
IT Security Specialist
Turvamies IT Security Services
www.turvamies.fi
#####################################################
This message has been checked for viruses and spam.
www.turvamies.fi info@turvamies.fi
#####################################################
--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005
