Notifications
Clear all
Topic starter
14/09/2010 3:52 pm
Will i be able to check if an email sent by an user was recalled?
The user was using Outlook 2003 and I have the image of the laptop. Is there an artifact that I can checked to verify my finding?
15/09/2010 10:07 am
Yes there is an artifact. It is a flag stored within the message store for that email.
I presume you have the email on the laptop? Stored in a PST?
If you don't have the email, then you wont be able to find if it was recalled.
If the email is in a PST - then process that PST using libpff and examine the flags that the pffextract tool parses out.
Microsoft has also made public the structure of PSTs and OSTs. The data you are looking for will be found within that.