glenn888 Posted January 21, 2014 Report Posted January 21, 2014 Is it possible to identify the deleted items and the date of deletion if the data sets are extracted from EnCase (not from DD images).
ŁukaszBachman Posted January 22, 2014 Report Posted January 22, 2014 Hi Glenn! Recovery of deleted items is not currently supported for EnCase images. We might consider it at some point in the future. How often do you find a need for such feature? Is that something you would find useful on day-to-day basis?
glenn888 Posted January 22, 2014 Author Report Posted January 22, 2014 Hello Lukas Thanks for your reply. Just a follow up question. After loading relevant files including emails and PSTs in Intella, for deleted email, does it get recovered BACK into the inbox or does it gets recovered to "deleted items". I would understand it being recovered to "deleted items" if it was already there I.e a soft-delete, but a hard-delete (shift-delete) on a email in the inbox... Where does Intella recover that to? Cheers!
ŁukaszBachman Posted January 28, 2014 Report Posted January 28, 2014 Intella tries to recover as much as it can from PSTs and OSTs. All discovered items are then placed in the special folder named . You can look up this information in Intella's Users Manual, section "9.2.2 Adding an MS Outlook file (PST, OST) source".
Recommended Posts