Re: Carving deleted messages from PST file remains

Was this outlook client connecting via exchange? If so, besides the backup 
itself mentioned by Kent, transaction logs, deleted item retention, or 
message tracking logs could alsoprovide information you need. Age of mail is 
a factor too since alot gets cleaned up by the system automatically. How 
long ago were the messages in question sent&deleted?

Post back for the sake of general knowledge for everyone else on this 
(unless I'm just missing a post somewhere where this was covered)

-Jeff
.
----- Original Message ----- 
From: "Newsfeeds" <kentshaw@newsfeeds.com>
To: "'Jyri Hovila'" <jyri.hovila@turvamies.fi>; 
<forensics@securityfocus.com>
Sent: Tuesday, June 14, 2005 9:37 PM
Subject: RE: Carving deleted messages from PST file remains


> If the email account was on an Exchange server, you can likely retrieve
> these from server backups.  Sometimes, it is possible to retrieve deleted
> emails messages from the .PST file, if the .PST file has not been 
> compacted,
> by intentionally corrupting the file index and then using the Microsoft
> Scanpst utility to rebuild the file.  Only try that technique with a 
> backup
> copy of the .PST file since success is not assured and you may make the 
> file
> unreadable.  In your case, the decreased file size suggests that the file
> was compacted after the email was deleted.  I have not found an easy way 
> to
> reconstruct a .PST file with saved email.  You may be able to manually
> rebuild it with Microsoft Access, but I don't see a benefit.  Two good
> utilities for searching email that aren't in a .PST file are X1
> http://www.x1.com/ and the Copernic Desktop Search 
> http://www.copernic.com/
> .  Both programs will index all the files on a hard drive and permit easy
> retrieval.
>
> I did a white-paper on retrieval of Outlook email for my office.  I will 
> see
> if I still have a copy.
>
> Kent Shaw,CPA,CCP,A+,Network+,Security+
>
>
> > -----Original Message-----
> > From: Jyri Hovila [mailto:jyri.hovila@turvamies.fi]
> > Sent: Monday, June 13, 2005 3:51 PM
> > To: forensics@securityfocus.com
> > Subject: Carving deleted messages from PST file remains
> >
> > Dear all,
> >
> > I'm investigating a case in which deleted e-mail messages play a
> > significant role. The suspect has deleted his e-mails from within
> > Outlook, so that the size of the PST file has shrunk from hundreds of
> > megabytes to hundreds of kilobytes. The deleted messages are still on
> > the hard drive, but "outside" the PST file. This means that the
> > messages can be accessed, but not in easily readable format.
> >
> > I'm looking for a way to use the file carving method to restore
> > individual e-mail messages. The idea is to locate the messages using a
> > variation of file carving, and then trying to create a working PST file
> > from the individual messages.
> >
> > Another idea that has crossed my mind is extracting the free space of
> > the hard drive in question into files, and then running these files
> > through a PST file recovery program. Preliminary tests suggest that
> > this may actually work.
> >
> > If anyone is aware of a standard delimiter or message header in the PST
> > file, used to mark the beginning of a new message (or other Outlook
> > item), I would be happy to hear all the details.
> >
> > All other comments are also welcome.
> >
> > Yours,
> >
> > Jyri Hovila
> >
> > IT Security Specialist
> > Turvamies IT Security Services
> > www.turvamies.fi
> >
> >
> > #####################################################
> >  This message has been checked for viruses and spam.
> >  www.turvamies.fi info@turvamies.fi
> > #####################################################
> >
> > --
> > No virus found in this incoming message.
> > Checked by AVG Anti-Virus.
> > Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005
>
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.323 / Virus Database: 267.7.2 - Release Date: 6/14/2005