Hi,
You might want to check out LoPe
(http://www.evidencetalks.com/forensic_toolsets/email_forensics.php) which
does exactly what you're describing below - and its forensically sound.
I use it mainly to convert pst files into individual mails, to be able
to handle for instance more than 500 pst files without including them
into outlook (very painfull). Haven't found any other way to do that
efficently.
Cheers
Andy
-----Original Message-----
From: Dietmar Mauersberger [mailto:news@mausburger.de]
Sent: 18 June 2005 16:53
To: forensics@securityfocus.com
Subject: Re: Carving deleted messages from PST file remains
Jyri Hovila wrote:
Dear all,
I'm investigating a case in which deleted e-mail messages play a
significant role. The suspect has deleted his e-mails from within
Outlook, so that the size of the PST file has shrunk from hundreds of
megabytes to hundreds of kilobytes. The deleted messages are still on
the hard drive, but "outside" the PST file. This means that the messages
can be accessed, but not in easily readable format.
I'm looking for a way to use the file carving method to restore
individual e-mail messages. The idea is to locate the messages using a
variation of file carving, and then trying to create a working PST file
from the individual messages.
Another idea that has crossed my mind is extracting the free space of
the hard drive in question into files, and then running these files
through a PST file recovery program. Preliminary tests suggest that this
may actually work.
If anyone is aware of a standard delimiter or message header in the PST
file, used to mark the beginning of a new message (or other Outlook
item), I would be happy to hear all the details.
I've found a description of older pst file formats in a project called:
libpst
Available at http://sourceforge.net/projects/ol2mbox
You will find a detailed description of the pst file format in the
libpst package. I don't think it works for all versions of pst,
especially the newer ones could cause some trouble with attachments.
But it is still very interesting...
I use it mainly to convert pst files into individual mails, to be able
to handle for instance more than 500 pst files without including them
into outlook (very painfull). Haven't found any other way to do that
efficently.
Dietmar
