Wonder if anyone can help.. and I know this is a very open ended question that would have different specific answers determined by the tool used, the version of exchange/outlook used to create the OST etc but here goes.
What metadata related to the individual emails generally could be changed/altered when converting from an OST to a PST.
ie would read flags get reset?
possible the created (not sent/received) date gets changed?
ENTRYID would certainly change I would imagine? (assuming an OST stores an entryid? - I am not sure)
Any responses would be appreciated and apologies the question is so non-specific. 😉
I would suggest this is a job where you have to do some experimentation. Have a look at the recent post on SANS from the gents at Hoffmann in NL the guys there are very advanced in this area of work.
https://
H