Appendix C: Deleted email items

Facts about deleted email items

The following are true, with regard to deleted items:

Deleted items are rarely present in application-created PSTs. They are typically found only in PSTs created by end-users.

Nuix Workstation does not find every deleted message. The regular use of a Microsoft email client ensures that permanently deleted items are overwritten. As these messages or attachments are overwritten, they cease to be recoverable.

Compressing PSTs and OSTs removes deleted items.

About PST property blocks and PST blocks

When scanning for deleted information, Nuix Workstation attempts to reconstitute the complete PST item. Each PST has an associated property block that contains all the basic metadata associated with it. For types of metadata that have large values associated with them, such as the main text of the item, the internet headers or attachments are located via additional file pointers.

With deleted items, often these pointers are no longer valid, so many of the deleted items found are these "orphaned" property block items. These represent old PST items that can no longer link to their larger metadata values but may still contain useful information.

PST blocks are chunks of data that are no longer referenced. For example, a large PDF attachment will be broken up into 4kB blocks. When the item associated with the attachment is deleted, the blocks of data are put on a free list, but often still contain the old data that was resident in the block and may still contain valuable information.

All extracted metadata properties are included in the text (body) of the document to ensure that this information can be exported in a usable format.