What are the best tools to carved or recover OLK15message & Attachment emails found in MAC OS 10.11 .
Also, I can see some changes in Files and Folders in MAC OS 10.11 . Has anyone encountered any special changes and has performed forensics on it?
The best tool is a Mac in your office to examine the files using a current copy of Outlook (Office for Mac 2016 with all updates) You first copy out the Main Profile folder from the evidence file. ( located at /Users/"username of interest"/Library/Group Containers/"alphanumeric-string".Office/Outlook/Outlook 15 Profiles/)
You create a new user profile with administrator rights on the Mac that has Office for Mac. You open Outlook for Mac and then let it create its profile. Then you close Outlook and use the same Main Profile folder type location as listed above and delete its "Main Profile" folder and replace it with the one you exported from the evidence.
Open and then boom - you have the email - you can export it to .olm and then use a converter program (Aid4Mail or OLMtoPST Convert Pro) to export it out to PST.