A Prominent PST Probe Tool To Recover Deleted Data From PST File!

Investigators usually cease hard disks for investigations where they can find several files of different formats for examinations. As emails are considered a foolproof source of evidence defining portrayal of suspect’s activities, email files are prime files for examination. This can help investigators to outline the activities of the suspect reaching to a conclusion or motive of the criminal case. Outlook email application developed by Microsoft is the most commercial and worldwide adapted desktop email client. Investigators many times come across Outlook PST investigation to recover deleted data from PST file, especially during corporate forgery cases. Emails are major carriers of virus infection and hence can be used for spreading malware through network.

Why Is Data Mining of Deleted Email Data Necessary?

Email analysis can be difficult, especially the deleted data items from Outlook data file. There is high probability that suspect has tried to manipulate the email data and might have even tried to eradicate important emails which have traces of crime. In many other cases, deleted items like emails or contacts can hold some clue for the case, which in normal investigation will not be disclosed. Hence, while performing Outlook email application scrutiny it is important to recover data from corrupt PST file. This recovered email data can help for examination.

How Can Hex Editor Help At Some Extent?

Hex Editor can be an ultimate solution for recovering the lost email data. It is highly recommended to perform this recovery procedure on PST copy instead of original PST files.

• Open PST file in Hex Editor.
• Delete positions 7 through 13, which will clear the 13 characters in positions: 00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
  0000e, 0000f, 00010, 00011, 00012, 00013.
• Once the characters are cleared, editor will display “20” code in their position.
• Save this edited PST file, which has been corrupted due to editing done using Hex Editor.
• Now, execute Inbox Repair Tool (ScanPST.exe) on the file to recover data from the file to another PST file.
• This ScanPST.exe utility will create a backup and will repair damaged PST file recreating the damaged file.

This recovered PST file will comprise of the deleted items of PST files as well as it repairs the corrupted items and deleted items. However, there are high chances that the file is severely corrupted and even the data, which was earlier accessible, is not viewed. In such situations, users can try better investigative solution like PST data Viewer to preview and recover data from corrupt PST file.

How To Recover Deleted Data From PST File?

The software is a freeware application, which provides a platform to perform analysis on the Outlook data file. It also helps to explore the deleted items from Outlook data file for performing examination on it. Let us see how it can be done;

• Install the software in your Windows system to recover deleted data from PST file and then click on Add File.
• This will pop up another window where you can navigate to the PST file location. Click on Select File and provide the path location of the PST file.
• Since deleted items have to be recovered, check the Advance Scan option and then click on Add File.
• This will scan the PST file thoroughly displaying recovered deleted items along with other items as well.
• All the emails can be read along with the technical properties like Subject, To, Sent, Size,
• Individual emails can also be viewed along with attachments without any complications.

Deleted data of any desktop email client can be a crucial segment to search for evidence. However, recovery of deleted data can be done through very advance technologies embedded in technical utilities. PST Viewer is a convenient investigation utility, which endures recovery of permanently deleted data from different types of PST files: ANSI and Unicode. Its prevalent technique is unique to provide the details in readable form for performing analysis.