I recently have a task to determine whether an email has been received and opened/read. The email client is either Outlook or Lotus Notes. I will be imaging a target harddrive and extract email files from a server.
The first question is quite simple, I will just recover all emails from PST/OST and see if the email is there. But I have a question on how to recover deleted emails from Lotus Notes' NFS.
The second question, I understand from readings through websites that there are status for local PST files as well as Exchange Server. My question are where exactly the flag is located in an email. And is it a configuration file or a hex value in the email? For Lotus Notes is quite straight forward. I will just load the NFS file using ID file and password to view the inbox.
Please correct me if I misunderstand.
Cheers.