Expert Witness Blog
In Challenges in Recovering Deleted Email, electronic discovery expert witness Steve Burgess writes:
There are three main types of email in common usage – Microsoft Outlook (often paired with a Microsoft Exchange Server), text-based email client programs, and web-based email, or webmail.
In Microsoft Outlook, all emails are kept in one large, encrypted, non-text file – the PST, or Personal Folders file. Outlook has additional functions and additional content as well. There is an integrated address book, multiple mailboxes, a calendar, and a scheduler, all of which are contained in the PST file. When one looks into a PST file with a file editor or word processing application, there is little or nothing intelligible to the human eye. The file content looks like nearly random characters.
In general, the PST file must be loaded into Outlook to be read. When an email is deleted, or even when it is purged, it may be kept within the body of the single large file, but become inaccessible to the program. Some deleted emails may be recovered by manipulating the file though a manual process, repairing the resultant file, and then loading back into Outlook.