Outlook邮件删除恢复技术的分析与实现  

Analysis and Implementation of Scan Recovery Technology for Outlook E-mails

作　　者：吴彬[1] 谢正颢 何吟[1] 袁文勤[1] 夏荣[1] 丁显鹏 

机构地区：[1]上海市公安局网络安全保卫总队,上海200025 [2]盘石软件(上海)有限公司,上海200333

出　　处：《软件产业与工程》2014年第4期33-36,共4页

摘　　要：在电子邮件取证领域中,Outlook邮件的分析和提取一直是业界关注的重点,目前已有很多成熟的技术。由于PST文件自身结构的复杂,对于邮件的恢复很少有人涉及。本文主要针对PST文件中彻底删除的邮件、已损坏的PST文件及未分配簇中的PST文件片段,提出一种扫描过滤的恢复方法,并描述如何实际应用这种恢复技术。In the field of e-mail forensic, there are a lot of mature technologies to analyze and extract the mails in PST file. Because of the complex structure of the PST file itself, few researches are involved in the recovery of the deleted mails. This paper proposes a scanning recovery method mainly for completely deleted mail in PST file, corrupted PST files and the fragment of PST file in unallocated clusters, and then describes how to use this technology in practice.

关 键 词：邮件取证 PST文件 邮件恢复 

分 类 号：TP393.098[自动化与计算机技术—计算机应用技术]