论文部分内容阅读
在电子邮件取证领域中,Outlook邮件的分析和提取一直是业界关注的重点,目前已有很多成熟的技术。由于PST文件自身结构的复杂,对于邮件的恢复很少有人涉及。本文主要针对PST文件中彻底删除的邮件、已损坏的PST文件及未分配簇中的PST文件片段,提出一种扫描过滤的恢复方法,并描述如何实际应用这种恢复技术。
In the field of e-mail forensics, Outlook mail analysis and extraction has been the focus of the industry, there are many mature technologies. Due to the complicated structure of the PST file itself, few people are concerned with the recovery of the mail. In this paper, aiming at the completely deleted mail in the PST file, the damaged PST file and PST file fragments in the unallocated cluster, this paper proposes a scanning and filtering recovery method and describes how to apply this recovery technique.