Email · PST · OST · deleted messages · forwarding rules · auto-delete · mailbox
Email archives: PST, OST and mailbox rules. A local mail file holds more than the inbox: deleted messages, and the quiet rules that forward or hide mail.
Email is still where a great deal of business and personal evidence lives, and much of it sits in the local mail file that desktop email clients keep on the computer, a PST or OST file, which the examination can open and search in full. That file holds the folders a user sees, but it also holds deleted messages that can be recovered from within it, and it records the account's rules, including rules that quietly forward incoming mail to an external address or divert and delete mail from particular people. In a dispute, those rules can matter as much as the messages: a rule forwarding all mail to a personal address, created just before a resignation, is a telling artefact. The report sets out the relevant messages, with their senders, recipients, dates and subjects, recovers deleted ones, and lists the rules with their creation times. It is clear that it recovers what is on the device; what was forwarded onward after a rule was created is held elsewhere, and message headers, which can be forged, show a claimed origin, not a proven one.
Rather talk it through? An engineer answers the bench line
0800 6890668
What a mail file holds, and what the rules reveal.
Desktop email clients keep a local copy of the mailbox on the computer: Outlook uses a PST file for accounts that store mail locally and an OST file for accounts synchronised with a server, and other clients use their own formats. The examination opens these files and can search them in full, recovering messages relevant to named people, accounts or assets, with their senders, recipients, dates, subjects and attachments.
Beyond the visible folders, a mail file holds deleted messages that can often be recovered from within it, including messages removed from the Deleted Items folder, and it records the mailbox's rules. Rules are where a quiet arrangement shows: a rule that forwards every incoming message to an external address, or one that moves to Deleted Items any mail from a particular colleague, is recorded in the mail profile with the time it was created. Such a rule, created shortly before a departure or a dispute, is frequently as significant as any single message.
The report recovers the relevant messages and the rules, and states the limits with care. It recovers what is on the device; mail forwarded onward by a rule after its creation is held in the recipient's systems, not this one. And a message's headers record its claimed path and sender, which can be forged, so the report presents headers as what a message asserts about itself, not as proven origin.
What it records, and what it means.
Describe your situation →| What is recorded | Where it comes from | What it shows, and does not |
|---|---|---|
| Relevant messages recovered | The local PST or OST mail file | Sender, recipient, date, subject; not the truth of the content |
| Deleted messages | Recovered from within the mail file | Messages removed, including from Deleted Items; where they survive |
| Forwarding and auto-delete rules | The mailbox rules in the mail profile | The rules set and when; not what they forwarded onward |
| A message's claimed origin | The message headers | What the message asserts; headers can be forged |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
From the bench
- Preserve the computer with its mail file intact; continued use can purge recoverable deleted messages.
- Ask about the rules, not just the messages; a forwarding rule created before a departure can be the key artefact.
- Do not rely on a header as proof of sender; it shows a claimed origin, which can be forged.
A forwarding rule created just before a resignation is recorded in the mailbox with its creation time, and can be as significant as any single message.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can you recover deleted emails?
Often, yes. Deleted messages can frequently be recovered from within the local mail file, including messages removed from the Deleted Items folder, so long as the file has not been purged by continued use. The report sets out the recovered messages with their senders, recipients, dates and subjects.
Can you show that someone was forwarding our mail?
Where a forwarding rule was set in the mailbox, yes: the rule is recorded in the mail profile with the time it was created, and the report lists it. What it cannot show is what was forwarded onward after the rule was created, because that mail is held in the recipient's systems, not on the examined device.
How reliable is the sender shown on an email?
A message's headers record its claimed path and sender, and headers can be forged, so we present them as what the message asserts about itself, not as proven origin. Establishing a true sender usually needs information from the mail providers, which is a matter for the police or the court.
Do you read all the emails?
We search and recover the messages relevant to the scope, named people, accounts, assets, or the allegation, and we do not reproduce unrelated personal correspondence beyond what the matter requires. The examination is scoped, not a trawl.
What does it cost?
Email examination is part of the standard forensic report, £800 + VAT for a one-disk system. The first conversation is free.
The record is on the device; preserve it first.
The first conversation is free. Tell us the situation and who owns the device, and we will tell you what the evidence can show, what it cannot, and whether we can take it on. Until then, stop using the device and preserve it as it is.