Forwarded Email Analysis

Not sure if FTK scans the PST for deleted items still within the PST.

Export the PST and use the repair tool it may recover the deleted sent items.

When i export these forwared emails and on open it on outlook it shows it has been forwarded on a certain date. Is there any way that i can determine who it was forwarded to?

If an email has been forwarded, the recipient wil be in the To field? I might be missing the point here, but how do get a Forwarded email with no recipients? Where did you get the email from?

AFAIK in Outlook you could achieve this by
Opening the original item in Inbox
Clicking on Forward
Closing the email without entering any recipients (you may or may not have entered text and/or attached files), and saving in Drafts

I've done it lots of times, sometimes I save in drafts because I want to cool off and go back to it later, sometimes I need to dig around to find the info I want to put in the FW Either way, not unknown for me to completely forget that the item is in Drafts at all.

Cheers

Thanks gents. I have already exhausted the methods that you have mentioned. the original message sits in his Inbox. FTK flags it as been forwarded and likewise in outlook. but there is no traces of the forwared email with recipients in either sent items or draft.

So was it forwarded to your guy then?

Ok am thinking straight now )

So you're saying the suspect has deleted the Forwarded message and you can't find it. Are we talking Exchange or local PSTs?

If Exchange, deleted (even hard-deleted) emails will hang around for xx days in the Dumpster on the server before finally disappearing off the face of the earth, default for xx I believe is 30 although we work to 14.

If PST, SANS408 course says that deleted messages may be recoverable from a PST (although didn't specify how), unless Compact has been run in which case it's game over.

HTH