Find and Examine Missing Outlook Data for Forensics Investigation

Approved By Aswin Vijayan

Published On April 30th, 2022

Reading Time 7 Minutes Reading

Category Data recovery, Email Forensics, Outlook

“Hello there, I am a forensic investigator and currently looking into an Outlook 365 profile for investigation. In this case, Outlook items data plays a major role in the inquiry to get out the truth of facts. But it appears that some of the important data is missing from the files which may help to collect the pieces of evidence. Even if the trash folder is also empty, which means data is hardly deleted with the intention to hide something. So, now in this Outlook forensics scenario, it becomes more important to retrieve the missing data from Outlook with all attachments to get the shreds of evidence. Is there any solution to find and examine missing Outlook data for a forensics investigation, please share!”

Such kinds of situations may arise in fraud and criminal cases when sometimes the culprit intentionally deletes data himself to hide the sensitive information. Forensic officers have to face these situations in almost every case related to Outlook Email Forensics. Moreover, the disappearance of Outlook files/folders occurs sometime due to technical issues. To solve these issues, firstly it’s important to understand the actual reason behind the scene. Let’s discuss the possible circumstances, due to which PST data is missing in the Outlook profile. And later we will understand how to find and examine missing Outlook data for forensics investigation

Possible Circumstances of Data Disappearing from Outlook

Sometimes, Outlook PST files may go missing due to technical reasons which can create hurdles in Outlook Digital Forensics. These reasons can be like:

Mail Items moved to archive folder
PST files or folders are hidden.
Corruption in data files.
Applied improper function to view.
The folder or file is damaged.

These are some reasons, why files or folders in Outlook are not shown. In all these scenarios, there is a whole file or folder disappeared. But in case, if data is missing from the files and folders, then the reason is not technical. It is surely deleted by the culprit or someone else with the intention to hide something.

There is no manual method available to retrieve lost items from Outlook, so it becomes a typical situation when a user needs to get back the missing data. To recover the missing data in the files or folders of Outlook, the user needs to opt for any third-party tool i.e. Outlook Deleted Items Recovery Tool. It is a fully advanced feature forensics tool that not only works to find and examine missing outlook data for forensic investigation but also provides many advanced features to examine the Outlook profile properly. First, let’s take an overview of the highlighted features of this Microsoft Outlook Forensics software.

Highlighted Features of the Outlook Forensics Software

Outlook forensics tool retrieves, opens, view and save deleted data from healthy as well as corrupted Outlook files (.ost/.pst/.bak).
Provide different file formats (PST, HTML, MSG, PDF, EML, Office 365) to save restored data.
Supports the option to “Save Permanently Deleted Items Only”.
Tools Display all Outlook email messages with metadata.
Facilitate removing encryption (SMIME & Open-PGP) from Outlook Email.
Preview Grid available to show recovered items in Red Color.
Maintain recovered items hierarchy the same as the original.
Compatible with MS Outlook 2019 or all below versions.

Simple Steps to Extract & Examine Missing Outlook Data Using Software

The software is capable to find and examine missing outlook data for forensics investigation within just simple steps. Users can save the recovered data in different file formats. The steps are as follows:

1: “Download” and launch the software into the system.

2: “Add Files” (OST/PST/BAK) to the software.

3: The “Scanning Process” will start to load the files.

4: Displays recovered items After Scanning, the “Preview“.

5: Chose the file format (PST / PDF / MSG / EML / HTML / Office 365) and “Export” files at destination location.

After following these few steps, the missing data from Outlook data files will be recovered in the desired file format. Users can check the restored files at the selected destination location.

Software Capabilities and Techniques to Investigate Digital Forensics Outlook

This amazing portable Outlook forensics software is not only working to find and examine missing outlook data for forensic investigation but also provides more additional functionalities to help forensic investigators. Moreover, the tool provides a special feature of “Data Preview Modes”, which helps investigators to view and analyze file data information deeply. It has given 8 data preview modes. Let’s discuss them individually with the properties.

1. Normal Preview Mode

The software provides the option to preview the recovered file in “Normal Preview Mode” for Outlook email forensics. It shows the basic information clearly, related to the Outlook email including the Path of the file, Sender email Id, receiver email id, CC, BCC, subject of the email, Attachments, Time Stamps, etc.

2. Hex Mode

This mode provides the hexadecimal representation of files for Outlook 365 forensics. Thus, it helps forensics examiners in investigating the case, as it clearly shows the overwritten values on the hard disk if the suspect deleted something from the data.

3. Properties

All the properties of the email can be shown by this preview mode for Outlook OST / PST forensics. Thus, it clearly shows the hidden and important information of the email which can have a major lead. It includes information like message ID, body details, message flags, etc.

4. Message Header View

Message Header is the most important component of email forensics. It can help investigators in Outlook email header forensics. This software provides the Message header view option which clearly displays all the information of the header.

5. MIME Mode

It is the most important aspect from the point of view of forensics which helps a lot in Outlook OST / PST files forensics. It defines the email protocol version, content type, content transfer encoding, etc. MIME was designed mainly for SMTP, it is clearly shown by this forensics tool to help the investigator while examining the SMTP protocol info.

6. HTML View

The HTML view of the data file is also provided by the software to show the original details related to Outlook files for forensic investigation. Sometimes scammers represent different links than the actual link embedded in HTML code. To clear this kind of issue, the software provides the HTML mode.

7. RTF Mode

The RTF is a rich text file format, it helps to view data in original formatting for Outlook, calendar/notes/journals/contacts/emails forensics. Moreover, this mode provides this software to help the investigation in analyzing the content in original text formatting. Sometimes it can help them to find out the lead.

8. Attachments

Attachment Mode facilitates showing the attachments directly, even without opening the whole message file. However, if an email has a deleted or corrupted attachment file, it will help to recover and view it in a healthy file format.

Conclusion

Here in this blog, we describe the best solution to find and examine missing outlook data for forensics investigation. There are many forensics tools available in the market, but we recommend here one of the best Outlook 365 forensics tools. It is not only capable to retrieve missing data from Outlook in different file formats but also provides many preview modes to view hide information of files which will help investigators in Microsoft Outlook forensics.