Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20110

General Discussion: Outlook PST File Footer / Carving

$
0
0
Good luck, but carving a PST file is very unlikely to work. My reasons are that PSTs tend to be large. PSTs tend to grow. Both of these reasons mean that there is a very high chance that the PST will be fragmented. Straight carving will not recover fragments - it requires extra intelligence to find potential fragments and stitch them back. Your best hope - for a NTFS disk is to see if you can find the relevant associated MFT entry for the file.

Viewing all articles
Browse latest Browse all 20110

Trending Articles