borderfox

Ok, I guess I will see what they can do... The short answer to that is that it's not a feasible option in this particular scenario (unfortunately). Is everyone else reading this of the same opinion? i.e. it will be a tall order for a data recovery lab to bring this data back?

Would a data recovery/digital forensic specialist fair any better in this regard - and be able to restore from the hard drive?

Thank you both for taking the time out to post. Yes, trying to retrieve emails but accessing via the exchange server is not a possibility in this instance. I have offline access to an outlook inbox on this machine. However, what I'm trying to do is restore a previous instance - when I would have logged in remotely some days previous . Is it likely that this data can be restored? Is there an instance of the .ost created every time the server is accessed? Are these seperate files....OR...can an attempt be made to restore the entire disk to a previous date?

Hello. I have a hard drive from a client computer - which would have connected remotely to an exchange folder and each time, the outlook folders would have been downloaded - overwriting previous instances - on the hard drive. Question1: Is it possible to recover a previous instance of outlook - from a specific date ....outlook with the data intact as it would have appeared 7 days ago (as an example)? Is this a .pst or .ost that get's re-written to the hard drive each time the client computer would have connected to the server? Question2: Is this something that I can use a software solution to attempt recovery - or will I need to hand this over to a lab? Question3: Is it possible to take an image backup of the drive - and examine it rather than the original? Thanks in advance for any insight you can provide with regard to my queries above.

Ok, thanks. That's much appreciated.

Yes, that's correct - internal only.

Sorry folks - my bad. Originally from IRL but in UK now - so discussed in the context of the UK. It was never the intention to discuss any legal aspects whatsoever. I felt it was necessary to give some background. Otherwise, the query is purely technical - regarding the mechanics of how servers could be examined to prove that data was tampered with. This is exactly the type of info I was looking for - thanks very much for taking the time to respond. As I don't have the technical expertise that you guys possess, can I ask do others agree that the above approach will work?

Well, lets just say that it's already in train - and will be running the full course. It's safe to assume that they were planted there with a view to discrediting the course of events that the complainant would be presenting. I hadn't considered it like this - so thanks for mentioning that. Looking at this from another angle, if we were to assume that it's possible for the complainant to have this checked (via a court order or other legal mechanism), given access to company systems, would an I.T. professional be likely to get evidence to prove this? Can anyone suggest how this could be approached? Are there people who specialise in this type of thing...i guess it's computer forensics, is it not?? It would be good to get a general opinion from I.T. savvy folk here - as to how this aspect of it could best be handled.

Your quite right. This was always from the outlook end -as the individual concerned did not contract to this organisation for anything remotely I.T. related. This individual is in dispute (as in pending legal action) with the organisation. Based on all of your comments above, it seems that it is plausable that the system could have been tampered with to facilitate the company 'planting' a number of emails in his inbox.....emails that will have a deleterious effect on him proving wrong-doing. Having come to this conclusion, the question now is how does he deal with this scenario? That is to say, how does he prove that these mails have been mischievously planted there - to weaken the grievance he claims against them?

Hi Ben. Thanks for your mail. I'm talking in terms of a concerted effort on behalf of senior management in this organisation - directing IT staff - to insert these mails after the fact. I can't go into the specifics other than to say that I am exploring this as it's a legal issue with high stakes for those involved. If they control the mail server - could they do this...that's my question. I note your point about datestamping on the email header -and so I will try and check that out. Actually, on that point, how exactly can I access the header information of a mail in outlook (apologies if this is basic but I'm not an IT professional). I'm suggesting it was done - then the individual logged in remotely from home - and these mails would then have propagated in their inbox. Subsequently, access was withdrawn.

The query is as per the thread title...but let me give some background first. Situation involves a sub contractor working with a multi-national corporation. He was working very closely with them - in so far as he had a user account on the company's internal email system. Without going into detail, a dispute arose. Outlook access was subsequently withdrawn. However, the individual can still view legacy mails up to that time - on the copy of outlook that's on their laptop. Upon reviewing mails, this individual has now noticed a handful of critical mails that they are 110% sure they had not received during the time in which they were working in close cooperation - onsite - with this company. However, the mails show up with dates suggesting that they were sent during the individuals time - working closely with the company. Is it possible - where a company have their own outlook server - that mails could be backdated and then sent out from a couple of the other company employees who are key to the issue at hand? The individual concerned would have logged in on a number of occasions in the weeks following this conflict coming to a head. Any input from anyone with experience of running an outlook server would be very welcome on the subject.