Outlook.pst incorre...
 
Notifications
Clear all

Outlook.pst incorrect header

3 Posts
3 Users
0 Likes
410 Views
(@jrobert)
Posts: 12
Active Member
Topic starter
 

I processed a virtual server with X-Ways and refined the volume snapshot. It recovered a number of carved pst files as well as pst files with user names and pst files in which the file name is "backup" or "archive". I noticed that the carved files have the correct pst file header. The pst files with unique names do not and are different from file to file. What is XWays using to identify the first cluster? I have searched the forum and Google without success.

 
Posted : 06/02/2017 11:37 pm
jpickens
(@jpickens)
Posts: 130
Estimable Member
 

Is it possible these are OST files? They have similar headers to PST files but the structure is different.

 
Posted : 06/02/2017 11:54 pm
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

You can export a spreadsheet detailing the signatures/footers/notes (internal verification) that XWF uses when carving directly from the RVS dialogue.

PST/OST has !BDN as the header.

 
Posted : 07/02/2017 1:45 am
Share: