Hi,
I am investigating a case in which I want to know when were the emails from pst file deleted.
I can see the mails in the deleted folder, but want to know when did the user delete these mails.
I have also come across a lost and found folder too in the pst file I am analyzing.
the pst i am analyzing does not have any folders as Inbox, sent, etc.
I want to find the exact activity the user could have performed on the pst, which i assume is to destroy the evidence.
Have a look at
http//
It's a document by Joachim Metz and available from the libpff sourceforge project.
I haven't needed the kind of information you are asking but this is where I would turn to try and get an answer.
Paul