Hello All,
I have identified few .ost files described in Encase as "deleted, overwritten".
But the custodian refuses to accept any activity of such deletion. Is there any possiblity or cause other than manual deletion or un-installation of Outlook, due to which ost file was deleted.
Also, can I take "entry modified" date as date of deletion.
Thanks in advance )
Hello All,
I have identified few .ost files described in Encase as "deleted, overwritten".
But the custodian refuses to accept any activity of such deletion. Is there any possiblity or cause other than manual deletion or un-installation of Outlook, due to which ost file was deleted.Also, can I take "entry modified" date as date of deletion.
Thanks in advance )
No you can't take that as date of deletion (and don't rely on EnCase descriptions that literally). Entry modified doesn't mean that.
As for whether there's any possibility of it not being manually deleted….yes would be the short answer and the fractionally longer answer would be I've no idea without serious amounts of testing. Does upgrading Outlook ever make temporary copies of the OST and then delete them? Does compacting/archiving do that? Does some other function do that? Is there a "live" OST present and these "deleted" ones might just be automatically generated/temporary copies? I'm sure there's an endless amount of possibilities. You'd need to test……but even if you couldn't recreate the scenario it wouldn't necessarily mean there wasn't a scenario you hadn't predicted that resulted in this.