MS Exchange Forensics

Content Leader: Jess Garcia - Last Updated: January 19, 2007

OST Files Recovery

• OST: MS Exchange Offline STorage format.

• An OST file is a replica of the Exchange mailbox stored locally in the client that helps speeding up exchanges while logged on to the server. If, because of any type of incident, a user's email account is deleted or corrupted at the Exchange server, the local .OST file can be used to recover Email, Contacts, Notes, Tasks, etc.

Recovery Procedure

• OST files can be indirectly readable by Outlook, using the following procedure:
  Source: http://channel9.msdn.com/ShowPost.aspx?PostID=164629

• Control Panel -> Mail -> E-Mail Accounts -> Add a new e-mail accountI
  • Microsoft Exchange Server
  • Server: 127.0.0.1
  • User Name: <The Username>
• Click More Settings -> Cancel (on the login box)
• When Started -> Manual Control -> Work Offline
  • Advanced -> Offline Folder File Settings -> Browse <Select> -> OK -> OK

• You can also use the tools mentioned below to convert from OST to Outlook PST file format.

References

• "OST to PST" discussion at MS Exchange Blog

Tools

• Stellar Phoenix Mailbox - Exchange Desktop
• Recovery for Exchange
• DataNumen Advanced Exchange Recovery

EDB & STM Files Recovery

• You can use the tools below to recover from corrupted MS Exchange Server Databases, .edb & .stm.

Tools

• Recovery for Exchange Server