Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Recommend Us
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: robval30
New Today: 2
New Yesterday: 1
Overall: 26159

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 LinkedIn Forensic Toolset - Beta Testers
 duplicators which can image without removing hard drive
 SMART for Linux - copy mount point
 Stegnography
 Software for Educational Forensics Work

Computer Forensics World Forums


Pages Served
We received
28673338
page views since August 2004

Security Sources

Firewalls
Cryptography
ISO 17799 ISO 27001
ISO 17799 Toolkit
ISO 27001 & 27000
Disk Analysis
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Recovering past instances of Outlook?
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Recovering past instances of Outlook?

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
borderfox
Newbie
Newbie


Joined: Aug 06, 2012
Posts: 4

PostPosted: Mon Aug 06, 2012 8:51 pm    Post subject: Recovering past instances of Outlook? Reply with quote

Hello. I have a hard drive from a client computer - which would have connected remotely to an exchange folder and each time, the outlook folders would have been downloaded - overwriting previous instances - on the hard drive.

Question1: Is it possible to recover a previous instance of outlook - so....outlook with the data intact as it would have appeared 7 days ago (as an example)?

Is this a .pst file that get's re-written to the hard drive each time the client computer would have connected to the server?

Question2: Is this something that I can use a software solution to attempt recovery - or will I need to hand this over to a lab?

Question3: Is it possible to take an image backup of the drive - and examine it rather than the original?

Thanks in advance for any insight you can provide with regard to my queries above.
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 435
Location: Marion, Indiana, USA

PostPosted: Mon Aug 06, 2012 9:39 pm    Post subject: Reply with quote

I will take #3 first. It is recommended that you work from an image and not the original.

You might try some data recovery software but I wouldn't hold my breath about recovering the data. The more the computer is used, the less likely recovery becomes.
Back to top
View user's profile
borderfox
Newbie
Newbie


Joined: Aug 06, 2012
Posts: 4

PostPosted: Mon Aug 06, 2012 11:27 pm    Post subject: Reply with quote

cybercop wrote:
You might try some data recovery software but I wouldn't hold my breath about recovering the data. The more the computer is used, the less likely recovery becomes.
The computer wouldn't have been used so much - although I guess several instances of the outlook data would have been downloaded to the local machine (in relation to the actual data that would have been written to the disk some 7 days prior).


Would a specialist data recovery lab be likely to fair any better in resurrecting this data?
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 435
Location: Marion, Indiana, USA

PostPosted: Tue Aug 07, 2012 5:36 am    Post subject: Reply with quote

If something like getdataback (payware) isnt able to find it, i doubt a lab will either.
Back to top
View user's profile
borderfox
Newbie
Newbie


Joined: Aug 06, 2012
Posts: 4

PostPosted: Tue Aug 07, 2012 7:10 am    Post subject: Reply with quote

cybercop wrote:
If something like getdataback (payware) isnt able to find it, i doubt a lab will either.
Ok, I guess I can try that myself. Is 'getdataback' as good as it gets? Are there any other software solutions I should consider?
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 927
Location: USA

PostPosted: Tue Aug 07, 2012 1:03 pm    Post subject: Re: Recovering past instances of Outlook? Reply with quote

borderfox wrote:
Hello. I have a hard drive from a client computer - which would have connected remotely to an exchange folder and each time, the outlook folders would have been downloaded - overwriting previous instances - on the hard drive.

Question1: Is it possible to recover a previous instance of outlook - so....outlook with the data intact as it would have appeared 7 days ago (as an example)?

Is this a .pst file that get's re-written to the hard drive each time the client computer would have connected to the server?
How is the remote connection established?
What version of Outlook? Exchange?
Depending on the answer to question one it might be a PST or it might be an OST file.
Need more information to answer the questions Cybercop did not already address for you.
Back to top
View user's profile
narnia25
Newbie
Newbie


Joined: Aug 07, 2012
Posts: 1

PostPosted: Tue Aug 07, 2012 6:42 pm    Post subject: Recovering past instances of Outlook? Reply with quote

I feature offline admittance to an prospect inbox on this tool.I'm trying to do is refund a early happening - when I would individual logged in remotely both days preceding.Is it likely that this collection can be repaired?
Back to top
View user's profile
borderfox
Newbie
Newbie


Joined: Aug 06, 2012
Posts: 4

PostPosted: Tue Aug 07, 2012 8:08 pm    Post subject: Re: Recovering past instances of Outlook? Reply with quote

PreferredUser wrote:
How is the remote connection established?

I'm assuming over a vpn connection. iPassConnect was used as part of the process of logging in to the machine itself, then getting on the www - and connecting with the virtual network.
PreferredUser wrote:
What version of Outlook? Exchange?

Outlook 2003. I'm not sure about exchange - no longer have connection to that server. Is there a way of telling via email headers?
PreferredUser wrote:
Need more information to answer the questions Cybercop did not already address for you.
I'm not an I.T. pro - so apologies if there is any lack of clarity in the above.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops © 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. © 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.