RE: Is it possible to recover recently deleted emails from an Outlook PST file?

From: Burnette, Michael <MWB(at)rh-law.com>
Date: Mon Nov 18 2002 - 09:32:22 EST

I think I misused the term "tombstoned" and thereby insinuated that the email would be kept in a deleted, yet intact, state for a pre-determined amount of time. That's not what I meant and that isn't what happens as you point out. Compaction will immediately remove unallocated space from a PST including deleted email assuming the PST file meets the minimum size requirements for compaction. Compaction will also leave a small amount free space, 16K or 4% of the file size before compaction, whichever is greater. That 4% can leave a lot behind depending on the file size. Compaction can be run manually or it can be set as an automatic process that runs when the CPU isn't heavily utilized. If a user doesn't set either, it is never compacted as far as I can tell.

Michael Burnette
Atlanta, GA     

-----Original Message-----
From: Bojan Zdrnja [mailto:Bojan.Zdrnja@FER.hr] Sent: Monday, November 18, 2002 6:03 AM
To: Burnette, Michael; 'Carlos Capmany'
Cc: forensics@securityfocus.com
Subject: RE: Is it possible to recover recently deleted emails from an Outlook PST file?

I don't think this is correct.
If you just delete e-mail from a PST, it will remain in it (even if try to permanently delete e-mail with shift+delete so you don't just move it to Deleted Items folder).
However, it will be actually removed when Outlook does PST folder compaction. I'm not sure how often Outlook does that process but you can do it manually by right clicking on your PST folder in Outlook and then go to Properties, Advance.

Best regards,

Bojan Zdrnja

> -----Original Message-----

This message and any attachments are intended for the use of the addressee(s) only and may be confidential and covered by the attorney/client and other privileges. If the reader is not the intended recipient, DO NOT READ, notify sender and delete this message. In addition, be aware that any disclosure, copying, distribution or use of the contents of this message is strictly prohibited.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 18 09:42:08 2002