E-Mail Forensics

“Email discovery” or “Email Investigation” are two of the most critical areas of most computer forensics investigations. There is no set phrase for this type of procedure, but they are sometimes called PST forensics, MS Exchange forensics, Exchange forensics, MS Exchange investigation, PST email discovery, PST examination, PST discovery and Email Forensics.

Disklabs Computer Forensics utilises very powerful tools and experienced staff to enable the thorough examination of all the clients email files. Disklabs Computer Forensics use tools such as Encase, FTK, Hot Pepper, Maresware, NTi, TopCat, LoPe, Disklabs WinHex,

Our tools have the ability to document various email formats, including Microsoft PST, DBX, (use in Outlook Express), Webmail, (such as hotmail, netscape, yahoo etc), mBOX files, (used in UNIX), and AOL.

Deleting items within Outlook goes through three stages:

The user deletes the email in the normal way, which transports the email to the Deleted Items Folder
The user then deletes the item from the Deleted Items Folder. This can be done in several ways, including simply deleting the files from the Deleted Folder, or holding the shift key whilst deleting the file will do this for you.
Exchange deletes the file from the store during nightly maintenance, (this happens when they file/email reaches the end of the deleted item retention period). This then removes the files from any and all indexes.