joachimm wrote:
hard deleted emails can also be recovered from the format. See:
https://googledrive.com/host/0B3fBvzttpiiScU9qcG5ScEZKZE0/PFF%20Forensics%20-%20analyzing%20the%20horrible%20reference%20file%20format.pdf
Recent versions of Outlook (since 2010 I think) seem to compact the file in background so you're likely not going to find much without using a tool that scans the disk for the messages. Plus the headers, message text and attachments aren't stored next to each another and worse of all the text is encoded according to a "permutative table" so you can't simply search the strings on disk (if I remember well Encase allows settings a special encoding for cases like this). Too bad there don't seem to be valid opensource Outlook PST/OST mail recovery tools available even though Microsoft made all the specs public several years ago.
↧