I processed a virtual server with X-Ways and refined the volume snapshot. It recovered a number of carved pst files as well as pst files with user names and pst files in which the file name is "backup" or "archive". I noticed that the carved files have the correct pst file header. The pst files with unique names do not and are different from file to file. What is XWays using to identify the first cluster? I have searched the forum and Google without success.
Is it possible these are OST files? They have similar headers to PST files but the structure is different.
You can export a spreadsheet detailing the signatures/footers/notes (internal verification) that XWF uses when carving directly from the RVS dialogue.
PST/OST has !BDN as the header.