How to Use DataNumen Outlook Repair for Outlook Forensics

In today’s post we examine how you can use DataNumen Outlook Repair for Outlook forensics.

MS Outlook is a critical tool for business communications. It is not surprising that it is used to close fraudulent deals to unsuspecting clients. In order to hide evidence, suspects often delete any communication that can incriminate them. In most cases, they hard-delete emails to make it hard for investigators to find the evidence.

However, it’s now possible for investigators to use advanced tools such as DataNumen Outlook Repair to perform Outlook forensics. This enables them to uncover even hard deleted mailbox objects.

Here’s how:

Scenario 1: When the PST file is intact

If the PST file is available, mount the drive that contains the Outlook data on a computer that has DataNumen Outlook Repair installed on it. Launch the software and go to the ‘Repair’ tab, select the target PST file as the input data. Also, specify where you want to output the recovered mailbox data.

Now go to the ‘Options’ tab and under ‘Advanced Options’ tick the check boxes corresponding to the options to recover deleted messages and folders. By selecting these options, the software will scan the drive for any deleted mailbox objects and recover them.

To begin the recovery process, tap the ‘Start Repair’.  When the recovery process is completed, you will receive a pop-up message showing the details of the recovered items.  Now launch MS Outlook and the recovered files. It is important to note that this approach works even when the PST file is corrupt and inaccessible.

Scenario 2: When the PST file is deleted

Sometimes a suspect can delete the entire PST file. While this makes it hard to get any mailbox data, it doesn’t mean it’s impossible to retrieve this information. However, you will need to be creative. You can start by creating a disk image of the drive that contained the PST file.

To achieve this, use tools such as DataNumen Disk Image, to clone the drive that contained the PST file. Mount the target drive on a computer that has the disk imaging software installed on it. Launch the program and select the ‘Clone’ option. Now choose the target drive and select a location to save the output disk image. This should not be the same drive as the source drive. Click the ‘Start Cloning’ button to create a disk image.

Once you create the disk image, open the DataNumen Outlook Repair tool. Instead of selecting a source PST file, select the disk image file. This will act as the source file. Remember to choose the options to recover deleted messages and folders. Also, specify the name of the output file and where it will be saved.

Start the recovery process by clicking the ‘Start Repair’ button. If all goes well, you will recover your deleted PST file. The application will also repair PST file if it was corrupt. Now use MS Outlook to access the recovered files. To maximize the chances of recovering most of the deleted data, it is advisable to avoid writing new information on the source disk. For instance, avoid installing new software on the target drive or saving new data.