[DFSci] recovering outlook pst

[Jesse Kornblum]

Hi Marc,

I am one of the original authors of Foremost. The other posters are
correct that you might be better off with a more specialized carving
tool. For what it's worth, here are some tips on using foremost to
recover the file you're looking for:

- You can adjust the header in the foremost configuration file or add
a new header. That is, make the header for 'pst' match the file you
see on the disk, or make a new entry for 'pst' in the foremost.conf
file.

- Wildcards in the headers are denoted with a question mark, '?'

- You can adjust the maximum size of files foremost will recover in
the foremost.conf file too. The number just before the header, in this
case 400000000, is the maximum number of bytes to grab. You can change
that to be an arbitrary value.


Good luck!

-- 
Jesse Kornblum
jessekornblum at gmail.com