A Guide to Recover Deleted Emails from Outlook to Carve Evidence

MailXaminer | October 7th, 2020 | Forensics

There exist a major influence in forensic tools i.e., the capability to recover deleted email messages. When a message is deleted from Outlook, it does not remove completely. What exactly happens is that the spaces from where the data is deleted exist as white spaces. This white space remains until the user chooses to compact or compress the file.

Additionally, Outlook also executes the regular process of compressing a PST file. It normally happens when the system is idle and Outlook is running. If the PST file is compressed, then the white spaces are overwritten by new data and there is no chance of recovering the deleted email messages. However, if the file is not compressed then deleted messages can be still recovered. There is couple of complexities associated in order to recover deleted emails from Outlook, let us have a look in detail.

Technical Challenges in Email Forensics Examination

The forensic examination of email messages is an important aspect in the digital forensic process. The legal process of digital investigation has many existing technical challenges. The legal procedure for the juridical agencies is needful on the existence of data. In Outlook, there is no proper recovery technique provided that will help the investigators to restore deleted Outlook email messages for the examination of evidence.

Examination of Microsoft Outlook data files i.e., OST or PST files is quite a complicated task and it is a time-consuming process. Therefore, investigators need a proficient forensic solution like MailXaminer Email Examiner Software that will help investigators to correlate data by analyzing OST/PST files from a number of computers. The smart filtering process and keyword search techniques of the forensic tool can help them to make the investigation procedures more convenient.

Analyzing Technicalities of Email Process Using MailXaminer

Often, investigators need to work a lot on creating links between messages to correlate the path of communication between sender and receiver. While doing so, they waste a lot of time in analyzing things. In such a case, using an intelligent tool that can carefully draw out the mode of communication is really beneficial.

Considering the technicalities that are mentioned above, it becomes very essential to seek help from an automated tool. It could resolve all the queries associated with the investigation procedure of an Outlook OST/PST file. Additionally, a forensic investigator can easily recover deleted email from Outlook to carve the evidence. MailXaminer is an email forensic tool that shows its proficiency in resolving all the complexities associated with the evidence examination.

Have a Look on How the Tool Work Effortlessly

MailXaminer is one of the most versatile tools for investigation procedures endowed with wide range of features and functionalities. Considering its technological aspects, it has worked well to resolve many of the well-known investigation cases.

With respect to the competent features, MailXaminer proves to be a helpful application for forensic investigators. It effortlessly resolves the investigation cases and helps to come up with culpable evidence quickly. Let us comprehend its performance by having a look at its ability to examine Outlook files and restore deleted email messages.

Recovering Deleted Emails

On loading the OST/PST file on the tool, it performs a scan of all the items to recover the permanently deleted items. The deleted items are marked in red on the right-hand side of the software pane.

Recover Deleted Emails from Outlook

Analyze Recovered File in Different Views

Further, to examine deleted messages thoroughly, the application is adapted with the proficiency to provide 10 different views of the same message. Available preview modes include Normal Mail, Hex, Properties, Message Header, MIME, Email Hop, HTML, RTF, Attachments, and Word Cloud.

Analyze Recovered File

Search for a Specific Keyword

Get the liberty of searching email messages through some keywords. Upon entering any susceptive keyword, it will filter out the messages that have a sneaky suspicion. For this, go to the ‘Keywords’ section, then add suspected keywords like approval, back, database, gram, etc. Now, the user can specify the desired keyword to fetch the emails related to the corresponding keyword.

The image below shows the filtering of messages on the basis of the keyword surface.

Search

Powerful Advanced Search based on Algorithm

MailXaminer provides multiple searching options based on advanced algorithms such as General Search, Proximity Search, Regular Expression, Stem Search, Fuzzy Search, and Wildcard Search. Besides these, users can avail the facility to search evidence using logical operator searches i.e., AND, OR, NOT.

Advanced Search

Link Analysis

To co-relate the mode of communication, the application provides ways to establish a diagrammatic relationship between the sender and receiver by showing the email communication links in between the users. This helps investigators in easily deciphering the connections (links) between the users (nodes).

Link Analysis

View Recovered Email Messages

The tool provides a direct option to view and open the recovered deleted messages. All the recovered data will be stored in “Deleted” folder that will show in red color after clicking on the “Deleted” folder. Users can perform multiple operations on the recovered data like Preview Emails, Keyword Searching, Advanced Searching, Link Analysis, etc. in the same manner as mentioned above.

View Recovered Email

Export and Save Recovered Evidential Data

The software provides option wherein the recovered deleted email data can easily be exported and saved locally in the user’s system. It gives a direct option to Export selected data at the desired location in any of the required file formats. It provides multiple file types as Output Format like EML, MSG, HTML, PDF, etc. By selecting any of them, the user can export the selected file or folder at any existing location in the user’s system.

Save Recovered Evidential Data

Final Words

While conducting the investigation process, one of the major tasks is recovering of deleted or lost data. Whether the data is deleted accidentally or intentionally, it must be recovered for proper investigation. As there is no manual process to recover hard deleted Outlook data files, so investigators usually opt for efficient forensic tools like MailXaminer. It is the feature-rich email forensic software that enables the recovery of deleted emails in Outlook. Moreover, users can search the evidence in the recovered email files using its versatile features in a convenient and systematic manner.