Email analysis can be difficult, especially the deleted data items from Outlook data file. There is high probability that suspect has tried to manipulate the email data and might have even tried to eradicate important emails which have traces of crime. In many other cases, deleted items like emails or contacts can hold some clue for the case, which in normal investigation will not be disclosed. Hence, while performing Outlook email application scrutiny it is important to recover data from corrupt PST file. This recovered email data can help for examination.<\/p>\n
How Can Hex Editor Help At Some Extent?<\/strong><\/h2>\nHex Editor<\/strong> can be an ultimate solution for recovering the lost email data. It is highly recommended to perform this recovery procedure on PST copy instead of original PST files.<\/p>\n\n- Open PST file in Hex Editor.<\/li>\n
- Delete positions 7 through 13, which will clear the 13 characters in positions: 00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
\n0000e, 0000f, 00010, 00011, 00012, 00013.<\/li>\n - Once the characters are cleared, editor will display \u201c20\u201d code in their position.<\/li>\n
- Save this edited PST file, which has been corrupted due to editing done using Hex Editor.<\/li>\n
- Now, execute Inbox Repair Tool (ScanPST.exe)<\/strong> on the file to recover data from the file to another PST file.<\/li>\n
- This ScanPST.exe utility will create a backup and will repair damaged PST file recreating the damaged file.<\/li>\n<\/ul>\n
![\"Recover](\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/11\/scanpst.png\")
<\/a><\/p>\nThis recovered PST file will comprise of the deleted items of PST files as well as it repairs the corrupted items and deleted items. However, there are high chances that the file is severely corrupted and even the data, which was earlier accessible, is not viewed. In such situations, users can try better investigative solution like PST data Viewer to preview and recover data from corrupt PST file.<\/p>\n
How To Recover Deleted Data From PST File?<\/strong><\/h3>\nThe software is a freeware application, which provides a platform to perform analysis on the Outlook data file. It also helps to explore the deleted items from Outlook data file for performing examination on it. Let us see how it can be done;<\/p>\n
![\"Recover](\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/11\/tool.png\")
<\/a><\/p>\n![\"download\"](\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/09\/download.png\")
<\/a><\/p>\n\n- Install the software in your Windows system to recover deleted data from PST file and then click on Add File<\/strong>.<\/li>\n
- This will pop up another window where you can navigate to the PST file location. Click on Select File<\/strong> and provide the path location of the PST file.<\/li>\n
- Since deleted items have to be recovered, check the Advance Scan<\/strong> option and then click on Add File.<\/li>\n
- This will scan the PST file thoroughly displaying recovered deleted items along with other items as well.<\/li>\n
- All the emails can be read along with the technical properties like Subject, To, Sent, Size,<\/em><\/li>\n
- Individual emails can also be viewed along with attachments without any complications.<\/li>\n<\/ul>\n
- \n
- Open PST file in Hex Editor.<\/li>\n
- Delete positions 7 through 13, which will clear the 13 characters in positions: 00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
\n0000e, 0000f, 00010, 00011, 00012, 00013.<\/li>\n - Once the characters are cleared, editor will display \u201c20\u201d code in their position.<\/li>\n
- Save this edited PST file, which has been corrupted due to editing done using Hex Editor.<\/li>\n
- Now, execute Inbox Repair Tool (ScanPST.exe)<\/strong> on the file to recover data from the file to another PST file.<\/li>\n
- This ScanPST.exe utility will create a backup and will repair damaged PST file recreating the damaged file.<\/li>\n<\/ul>\n
<\/a><\/p>\nThis recovered PST file will comprise of the deleted items of PST files as well as it repairs the corrupted items and deleted items. However, there are high chances that the file is severely corrupted and even the data, which was earlier accessible, is not viewed. In such situations, users can try better investigative solution like PST data Viewer to preview and recover data from corrupt PST file.<\/p>\n
How To Recover Deleted Data From PST File?<\/strong><\/h3>\n
The software is a freeware application, which provides a platform to perform analysis on the Outlook data file. It also helps to explore the deleted items from Outlook data file for performing examination on it. Let us see how it can be done;<\/p>\n
<\/a><\/p>\n<\/a><\/p>\n- \n
- Install the software in your Windows system to recover deleted data from PST file and then click on Add File<\/strong>.<\/li>\n
- This will pop up another window where you can navigate to the PST file location. Click on Select File<\/strong> and provide the path location of the PST file.<\/li>\n
- Since deleted items have to be recovered, check the Advance Scan<\/strong> option and then click on Add File.<\/li>\n
- This will scan the PST file thoroughly displaying recovered deleted items along with other items as well.<\/li>\n
- All the emails can be read along with the technical properties like Subject, To, Sent, Size,<\/em><\/li>\n
- Individual emails can also be viewed along with attachments without any complications.<\/li>\n<\/ul>\n
- This will pop up another window where you can navigate to the PST file location. Click on Select File<\/strong> and provide the path location of the PST file.<\/li>\n
- This ScanPST.exe utility will create a backup and will repair damaged PST file recreating the damaged file.<\/li>\n<\/ul>\n