[DFSci] recovering outlook pst

[Marc Fisher]

Hi Simson,
thanks for your input.
Actually you were right, while I was able to recover historical pst's using
foremost, the most recent messages were always missing.
I tried recovering messages with different tools (including photorec) and
was able to recover the majority of lost data. The rest could have been
already overwritten by the sloppy IT Manager who got convinced that recovery
was impossible after a trial version of Active Undelete (installed on the
same computer!) returned only garbage.

Thanks to people on this list I was able to solve the issue successfuly.

Marc
On Fri, Apr 8, 2011 at 12:35 PM, Garfinkel, Simson (CIV)
<slgarfin at nps.edu>wrote:

> Marc,
>
> The problem that you will have with using any first or second-generation
> carver (scalpel, photorec, foremost, etc), is that PST files are highly
> fragmented and these carvers do not do fragment recovery carving. (I believe
> that Photorec has limited ability to remove a single fragment within a file
> that results from UFS file systems, but I do not think that it can handle
> anything more complicated.)  Instead of attempting to recover the PST file,
> I believe you will have better luck trying to recover the individual
> messages.
>
> Simson
>
>