RE: Is it possible to recover recently deleted emails from an Outlook PST file?

From: Burnette, Michael <MWB(at)rh-law.com>
Date: Thu Nov 14 2002 - 09:05:45 EST

Yes, email is "tombstoned" in a PST. Fill one up, delete it, and see how large the PST remains!

There are many tools that can rip deleted items from a PST but the process described in the June 2002 HTCIA newsletter is easy, free, and works better than any other in my experience. Incidentally, I would suggest that anyone using a commercial tool to undelete email from a PST check your tool with this method.

http://www.htcia.org/pdf_files/vol3iss2.PDF

Michael Burnette
Rogers & Hardin LLP
Atlanta, GA

-----Original Message-----

From: Carlos Capmany [mailto:ccapmany@terra.es] Sent: Wednesday, November 13, 2002 7:23 PM To: forensics@securityfocus.com
Subject: Is it possible to recover recently deleted emails from an Outlook PST file?  

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Does anybody know whether Outlook does actually keep inside the PST file the contents of a deleted email, as long as it is not overwritten by a new one (ie, in the fashion of what happens with the contents of a deleted file in a FAT partition)?

Thanks,

Carlos

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPdLs1XKaFmwIEWWXEQKc0gCdFakj9o3HgAKbgXOtSQfQyc+NEeUAnjOg eLII+6COUbCm9bQlLDQABvBa
=EF/m
-----END PGP SIGNATURE-----

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

This message and any attachments are intended for the use of the addressee(s) only and may be confidential and covered by the attorney/client and other privileges. If the reader is not the intended recipient, DO NOT READ, notify sender and delete this message. In addition, be aware that any disclosure, copying, distribution or use of the contents of this message is strictly prohibited.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Nov 17 08:30:38 2002