| < Day Day Up > |
|
Outlook, installed with the Microsoft Office suite, is often encountered in corporate investigations. E-mail created from Outlook is even simpler to re-create than e-mail in Outlook Express. Files with the extension .pst are called “Personal File Folders” and are used by Outlook to store e-mail. Files with the .ost extension are called “Offline Storage Folders” and are used by Outlook to store a user’s offline e-mail that is normally synced with an Exchange server. Users can have both types of e-mail folders on their computers using Outlook.
After a suspect’s Personal File Folders are located, you can open them by choosing File | Open | Outlook Data File.
After you select a file, it is mounted in the folder tree. You can then browse the e-mail, calendar, tasks, and contacts contained within these files without interference from other existing e-mail in Outlook. In the next screenshot, the folder titled “Feb 1, 2002” is a Personal File Folder opened from a discovered file within our example evidence.
Operating System | Typical Location of Outlook Express Mail Storage |
---|---|
Windows 2000/XP/2003 | C:\Documents and Settings\<local username>\Local Settings\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\ |
Windows NT | C:\winnt\profiles\<local username>\Local Settings\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\ |
Windows 95/98/Me | C:\Windows\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\ |
Note | Although it is possible to import e-mail folders, it is not recommended that you do so because it is too easy to mix e-mails by incorrectly selecting the target folders for the import process. In addition, the import process is much more complicated than simply choosing File | Open and then importing the Outlook Data File. |
| < Day Day Up > |
|