Notifications
Clear all

FTK & deleted emails  

  RSS
Samuel1
(@samuel1)
Member

Hi everyone,

I am trying to pull some deleted e-mails from an image. In FTK, plenty of e-mails show up, parsed from PSTs/OSTs, I even added the column for "Deleted" and every entry is "False." It can't be that not a single e-mail was deleted. So, I am now going through the carved "gmail" data…

But, I am certain that e-mails have been deleted from Outlook. I read through the entire help file, is there no way to simply display/filter deleted Outlook e-mail data?

Thanks all~

Quote
Posted : 28/04/2014 12:00 am
Samuel1
(@samuel1)
Member

I am a little surprised ~ nobody here has ever had to do this in your investigations?! Seems like something that would come up rather often.

ReplyQuote
Posted : 29/04/2014 4:11 am
Share: