Do you have Encase? The one thing I have tried with some success is
perform a search over unallocated space with a keyword in Encase but
enabling the Outlook Compressed Codepage. This has allowed me to find
some e-mail fragments and carve them out.
Greg Kelley, EnCE
Vestige Digital Investigations
Computer Forensics | Electronic Discovery | Corporate Surety
46 Public Square, Ste 220
Medina, OH 44256
(330)721-1205 x5432
(330)721-1206 Fax
http://www.vestigeltd.com
-----Original Message-----
From: Jyri Hovila [mailto:jyri.hovila@turvamies.fi]
Sent: Monday, June 13, 2005 3:51 PM
To: forensics@securityfocus.com
Subject: Carving deleted messages from PST file remains
Dear all,
I'm investigating a case in which deleted e-mail messages play a
significant role. The suspect has deleted his e-mails from within
Outlook, so that the size of the PST file has shrunk from hundreds of
megabytes to hundreds of kilobytes. The deleted messages are still on
the hard drive, but "outside" the PST file. This means that the
messages can be accessed, but not in easily readable format.
I'm looking for a way to use the file carving method to restore
individual e-mail messages. The idea is to locate the messages using a
variation of file carving, and then trying to create a working PST file
from the individual messages.
Another idea that has crossed my mind is extracting the free space of
the hard drive in question into files, and then running these files
through a PST file recovery program. Preliminary tests suggest that
this may actually work.
If anyone is aware of a standard delimiter or message header in the PST
file, used to mark the beginning of a new message (or other Outlook
item), I would be happy to hear all the details.
All other comments are also welcome.
Yours,
Jyri Hovila
IT Security Specialist
Turvamies IT Security Services
www.turvamies.fi
#####################################################
This message has been checked for viruses and spam. www.turvamies.fi
info@turvamies.fi #####################################################
