Outlook

 < Day Day Up > 



Outlook, installed with the Microsoft Office suite, is often encountered in corporate investigations. E-mail created from Outlook is even simpler to re-create than e-mail in Outlook Express. Files with the extension .pst are called “Personal File Folders” and are used by Outlook to store e-mail. Files with the .ost extension are called “Offline Storage Folders” and are used by Outlook to store a user’s offline e-mail that is normally synced with an Exchange server. Users can have both types of e-mail folders on their computers using Outlook.

Implementation

After a suspect’s Personal File Folders are located, you can open them by choosing File | Open | Outlook Data File.

After you select a file, it is mounted in the folder tree. You can then browse the e-mail, calendar, tasks, and contacts contained within these files without interference from other existing e-mail in Outlook. In the next screenshot, the folder titled “Feb 1, 2002” is a Personal File Folder opened from a discovered file within our example evidence.

Table 24-1: Summary of Mail Storage Locations for Outlook Express

Operating System

Typical Location of Outlook Express Mail Storage

Windows 2000/XP/2003

C:\Documents and Settings\<local username>\Local Settings\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\

Windows NT

C:\winnt\profiles\<local username>\Local Settings\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\

Windows 95/98/Me

C:\Windows\Application Data\Identities\<unique lengthy string>\Microsoft\Outlook Express\

click to expand

Note 

Although it is possible to import e-mail folders, it is not recommended that you do so because it is too easy to mix e-mails by incorrectly selecting the target folders for the import process. In addition, the import process is much more complicated than simply choosing File | Open and then importing the Outlook Data File.



 < Day Day Up > 



Anti-Hacker Tool Kit
Anti-Hacker Tool Kit, Third Edition
ISBN: 0072262877
EAN: 2147483647
Year: 2004
Pages: 189

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net