Yes. A PST file works in a similar way to a database - when a message is deleted it is only flagged up as having been deleted, and is therefore not shown to the user. The message is only truly deleted from within the PST file when either a) another message overwrites it, or b) when the user compacts the mailbox. In order to recover deleted messages from a PST file you need to do the following: 1) Make a backup copy of the PST file being examined. 2) Using a hex editor that you are familiar with replace bytes 7 to 13 of the PST file with FF (they're usually set to 00). 3) Run a tool called "scanpst", which is usually resident in C:\Program Files\Common Files\System\Mapi\1033 on a windows box. It might not be in this directory, but should be installed by default. 4) Open the PST file and any recoverable messages should have been recovered. Please note - it doesn't always work. Best of luck. Craig G Earnshaw Head of Forensic Computing Services Lee & Allen Consulting Limited London - New York - Hong Kong ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Nov 18 2002 - 06:48:45 PST