borderfox Posted August 6, 2012 Posted August 6, 2012 Hello. I have a hard drive from a client computer - which would have connected remotely to an exchange folder and each time, the outlook folders would have been downloaded - overwriting previous instances - on the hard drive. Question1: Is it possible to recover a previous instance of outlook - from a specific date ....outlook with the data intact as it would have appeared 7 days ago (as an example)? Is this a .pst or .ost that get's re-written to the hard drive each time the client computer would have connected to the server? Question2: Is this something that I can use a software solution to attempt recovery - or will I need to hand this over to a lab? Question3: Is it possible to take an image backup of the drive - and examine it rather than the original? Thanks in advance for any insight you can provide with regard to my queries above.
sukh Posted August 6, 2012 Posted August 6, 2012 Depending how the user is storing emails, seems like they are using cache mode, so the data will be in a OST. Not sure what exactly is required here, seems like you're trying to recover emails? If yes, haven't you got any Exch backups? 1
achedgy Posted August 6, 2012 Posted August 6, 2012 The data should be still stored on the exchange server, anything recently deleted would be accessible via 'recover deleted items' by connecting another outlook profile to the exchange server. If Outlook is in cached mode and for some reason the user is unable to contact the exchange server (ie; they've left the organisation) the data should be stored in a .ost file. Seearch for the file, making sure show hidden and system files is set. You can download (paid for) a program to convert the file to a pst which you can import into another instance of Outlook 1
borderfox Posted August 6, 2012 Author Posted August 6, 2012 (edited) Thank you both for taking the time out to post. seems like you're trying to recover emails? If yes, haven't you got any Exch backups? The data should be still stored on the exchange server Yes, trying to retrieve emails but accessing via the exchange server is not a possibility in this instance. If Outlook is in cached mode and for some reason the user is unable to contact the exchange server (ie; they've left the organisation) the data should be stored in a .ost file. Seearch for the file, making sure show hidden and system files is set. I have offline access to an outlook inbox on this machine. However, what I'm trying to do is restore a previous instance - when I would have logged in remotely some days previous . Is it likely that this data can be restored? Is there an instance of the .ost created every time the server is accessed? Are these seperate files....OR...can an attempt be made to restore the entire disk to a previous date? Edited August 6, 2012 by borderfox
sukh Posted August 6, 2012 Posted August 6, 2012 not if the changes have been synced to the ost or you unless you created a new ost before the changes you made.
borderfox Posted August 6, 2012 Author Posted August 6, 2012 not if the changes have been synced to the ost or you unless you created a new ost before the changes you made. Would a data recovery/digital forensic specialist fair any better in this regard - and be able to restore from the hard drive?
sukh Posted August 6, 2012 Posted August 6, 2012 if the ost was deleted then mayne yes, if its sync'ed then unlikely, why can you ask the exch admins?
borderfox Posted August 6, 2012 Author Posted August 6, 2012 (edited) if the ost was deleted then mayne yes, if its sync'ed then unlikely Ok, I guess I will see what they can do... why can you ask the exch admins? The short answer to that is that it's not a feasible option in this particular scenario (unfortunately). Is everyone else reading this of the same opinion? i.e. it will be a tall order for a data recovery lab to bring this data back? Edited August 6, 2012 by borderfox
Roberto Posted August 7, 2012 Posted August 7, 2012 Ok, I guess I will see what they can do... The short answer to that is that it's not a feasible option in this particular scenario (unfortunately). Is everyone else reading this of the same opinion? i.e. it will be a tall order for a data recovery lab to bring this data back? Your chances of that working well are approximately equal to mine of winning £100 million on the lottery AND THEN getting them to have Anne Hathaway present the check. So no, then.
Recommended Posts