I think I misused the term "tombstoned" and thereby insinuated that the
email would be kept in a deleted, yet intact, state for a pre-determined
amount of time. That's not what I meant and that isn't what happens as
you point out. Compaction will immediately remove unallocated space
from a PST including deleted email assuming the PST file meets the
minimum size requirements for compaction. Compaction will also leave a
small amount free space, 16K or 4% of the file size before compaction,
whichever is greater. That 4% can leave a lot behind depending on the
file size. Compaction can be run manually or it can be set as an
automatic process that runs when the CPU isn't heavily utilized. If a
user doesn't set either, it is never compacted as far as I can tell.
Michael Burnette
Atlanta, GA
-----Original Message-----
From: Bojan Zdrnja [mailto:Bojan.Zdrnjaat_private]
Sent: Monday, November 18, 2002 6:03 AM
To: Burnette, Michael; 'Carlos Capmany'
Cc: forensicsat_private
Subject: RE: Is it possible to recover recently deleted emails from an
Outlook PST file?
I don't think this is correct.
If you just delete e-mail from a PST, it will remain in it (even if try
to permanently delete e-mail with shift+delete so you don't just move it
to Deleted Items folder).
However, it will be actually removed when Outlook does PST folder
compaction. I'm not sure how often Outlook does that process but you can
do it manually by right clicking on your PST folder in Outlook and then
go to Properties, Advance.
Best regards,
Bojan Zdrnja
> -----Original Message-----
> From: Burnette, Michael [mailto:MWB@rh-law.com]
> Sent: 14. studeni 2002 15:06
> To: Carlos Capmany
> Cc: forensicsat_private
> Subject: RE: Is it possible to recover recently deleted emails from an
> Outlook PST file?
>
>
> Yes, email is "tombstoned" in a PST. Fill one up, delete it, and see
> how large the PST remains!
>
> There are many tools that can rip deleted items from a PST but the
> process described in the June 2002 HTCIA newsletter is easy, free, and
> works better than any other in my experience. Incidentally, I would
> suggest that anyone using a commercial tool to undelete email
> from a PST
> check your tool with this method.
>
> http://www.htcia.org/pdf_files/vol3iss2.PDF
>
>
> Michael Burnette
> Rogers & Hardin LLP
> Atlanta, GA
>
> -----Original Message-----
> From: Carlos Capmany [mailto:ccapmanyat_private]
> Sent: Wednesday, November 13, 2002 7:23 PM
> To: forensicsat_private
> Subject: Is it possible to recover recently deleted emails from an
> Outlook PST file?
>
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> Does anybody know whether Outlook does actually keep inside the PST
> file the contents of a deleted email, as long as it is not
> overwritten by a new one (ie, in the fashion of what happens with the
> contents of a deleted file in a FAT partition)?
>
> Thanks,
>
> Carlos
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 7.0.4
>
> iQA/AwUBPdLs1XKaFmwIEWWXEQKc0gCdFakj9o3HgAKbgXOtSQfQyc+NEeUAnjOg
> eLII+6COUbCm9bQlLDQABvBa
> =EF/m
> -----END PGP SIGNATURE-----
>
>
> -----------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com
>
>
> This message and any attachments are intended for the use of the
> addressee(s) only and may be confidential and covered by the
> attorney/client and other privileges. If the reader is not
> the intended
> recipient, DO NOT READ, notify sender and delete this message. In
> addition, be aware that any disclosure, copying, distribution
> or use of
> the contents of this message is strictly prohibited.
>
>
> -----------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com
>
>
This message and any attachments are intended for the use of the
addressee(s) only and may be confidential and covered by the
attorney/client and other privileges. If the reader is not the intended
recipient, DO NOT READ, notify sender and delete this message. In
addition, be aware that any disclosure, copying, distribution or use of
the contents of this message is strictly prohibited.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Nov 18 2002 - 06:42:55 PST