Recovering deleted ...
 
Notifications
Clear all

Recovering deleted emails from .OST

cybertend
(@cybertend)
New Member

Hi folks, I am trying to recover any and all deleted emails on a particular users .ost.

I have tried Autopsy and SysTools Outlook Deleted Items Recovery.  Both come back with the same handful of emails recovered.  But we know there is a large amount of others deleted that these tools are not picking up.  

My process:

I have created a logical image of the system after logging in as the local administrator on the device(drive encrypted with bitlocker)

I load the image into Autopsy and let that run

I also mount the image with FTK and point to the .ost with the systools app:

\Users\%user name%\AppData\Local\Microsoft\Outlook\%user name%@%company.com.OST

Unfortunately retrieval of the users mailbox on the exchange server is not an option as, in this case, IT deleted the user and killed the mailbox as well a month or two back.  We could certainly go back and do a restore, but I dont want to get into that.

 

Thanks for the look and advice appreciated

Quote
Topic starter Posted : 16/04/2021 7:03 pm
TuckerHST
(@tuckerhst)
Active Member
Posted by: @cybertend

But we know there is a large amount of others deleted that these tools are not picking up. 

Your statement implies that the other deleted emails are in the OST but not being recovered by two completely different tools that both produce the same results. If so, how do you know this?

Perhaps you mean that you believe there may be additional deleted emails that can be recovered. If so, you might want to try another tool, such as X-Ways.

ReplyQuote
Posted : 28/04/2021 6:03 pm
Share: