Turning off PST compacting in Outlook?

I'm working a forensics issue and need Outlook help...

Does anyone know how to turn off the auto compacting feature of Outlook? I've read that after a particular PST file has approx 20% whitespace (from deleted items) it starts compacting the file. I need it to not do this so I can recover any deleted items.

I know the trick to use when trying to recover recent deleted items that are purged from the Deleted Items folder but need to keep Outlook from reusing that space and thus wiping out the deleted items.

I Googled for hours looking for this info with no luck so I figured I'd see if any AO gurus knew the answer.

Any help would be much appreciated.

Do you mean Outlook proper or Outlook Express?

Which version is it?

Cheers

EDIT: In Outlook Express (6.0) the wasted space factor in a .pst file is defaulted to 20%

open the Inbox
<tools>
<options>
<maintenance>

I would uncheck the "compact messages in the background" box , and set the wasted space factor to 100%. That should stop it compacting even an "empty" folder, but you never can tell with MS.............it would be lousy programming if it did:)

I have only had a chance to look at Outlook97. It does not seem to autocompact, it looks as if you have to do it manually. I am not sure of the versions that ship with Office2000, 2002 and 2003........................please let me know what you are using, I would expect the procedure to be pretty similar.

Outlook 2002.

Yeah, I found that tip for Outlook Express but Outlook 2002 doesn't have that.

Are you talking of the Auto archive feature??
Tools&gt;Options&gt;Other

Not sure if I am on track here...sorry if I misunderstood your question :rolleyes:

Morgan~ autoarchive is where it saves older items that you WANT to keep. Compacting is the feature that "defrags" the current post box file.

Ric-o as you confirm that you have Office/Outlook 2002 (sometimes known as Office XP) I have a machine like that I can set up for testing.

You might have another issue though, as the deleted files are quite likely to get overwritten, just like any other file. You might consider unchecking the "empty deleted items folder on exiting" That means that today's deleted items won't get overwritten by tomorrow's

Are you sure that Outlook 2002 actually has an autocompact feature.

I can remember on many occasions having to talk people through compacting O. Express when they were having performance issues. I do not recall that problem with the full Outlook product.

Are you sure that it actually does autocompact?

Cheers

As far as i know you have to manually compress your pst files in outlook 97 etc. the other thing to considier is if you are using exchange server.

I guess I misunderstood :eek:

Anyway...we have users here that never empty out thier deleted items....
they have deleted items that go 6 years back to when we first installed outlook and the Exchange server :rolleyes:

.so if you turn it off like nihil has suggested ...it should work....but whats stopping the user from emptying the deleted Items folder???

One thing about .pst files is if they get past 2 gigs they can become corrupted. I guess thats where the Auto Achive feature may come in handy.


MLF

Morgan~ I think you might have discovered another issue.

I think you would also need to disable:

"empty the deleted items folder on exiting"

"when online synchronise all folders upon exiting" and

"delete expired items when AutoArchiving"

Ric-o is this machine on a local mailserver using Exchange Server, or is it a machine that is stand alone and/or has an external mail provider.

Cheers

Within Outlook 2003 if you go Tools&gt;Options&gt;Other&gt;Auto Archive at the bottom there is an area for Retention Policy. Not sure if this applies to 2002.

Have not got time to investigate further. Hope this helps.

Yes jinxy it is there in 2002 as well, but the policy has to be set by the network administrator

Sorry everyone, stepped offline for a while.

morganlefay: Sorry for confusion...I'm NOT talking about AutoArchive but rather the automatic compacting of "white space" in Outlook PST file.

This is a standalone home Outlook install which pulls down mail from POP server.

Quote:

---

Originally posted here by nihil
Are you sure that Outlook 2002 actually has an autocompact feature.

---

Nihil: I'm not totally sure it does have one but this MS article and some other articles (dont have them handy) mentioned it. http://support.microsoft.com/default...NoWebContent=1.

Quote:

---

Automatic compaction takes place as an idle task in the background. The following conditions must be true for this background task to take place:
* Outlook must be running.
-and-
*The computer must not be engaged in other CPU-intensive tasks such as copying or downloading files.

---

It also mentions that the file had to be a min of 16KB in size and there was at least 16KB of "white space" available. Not a problem, the PST I'm talking about is 40MB+.

So that would lend me to believe it does auto compact...sigh not clear! I hope it's not automatic, obviously. I guess I need to test it by creating a new PST, moving a bunch of messages into it, delete some, and then wait to see if it auto compacts. I was hoping to avoid this process and not sure if I'll test it properly.

/EDIT:
Another article that talks about the auto compacting feature.
http://www.winnetmag.com/Article/ArticleID/22164/22164.html

Quote:

---

Outlook automatically compacts a .pst file when the file reaches a certain (but undocumented) size; however, for automatic compaction to occur, your PC must be completely idle.

---

OK ric-o sit down and hold on tight, here come some gross hacks :eek:

Try installing SETI@home or Folding@home. They will keep the CPU at full belt. Normal proggys will just grab resource from them, but it sounds as if the Outlook compressor checks CPU usage BEFORE it launches itself. In theory, if they are already taking the CPU up to 100%, the compressor will never start.

A slightly more elegant one:

1. Find the program that does the compression and rename it
2. Write a little script that puts up a message box "Compacting Outlook Files" for 15 seconds and name it the same as the original file and put it in the same place.

Outlook will call the proggy which will run, and I bet Outlook will be none the wiser.

How about that for a pure theft of virus design technology? :cool:

I have dug out my Outlook 2002 box and will have a look tomorrow and get back to you.

Cheers :D

Ok, I've done couple tests now and have confirmed that indeed Outlook does do some sort of automatic compacting without initiation when your PC is idle.

Test:
* Left Outlook alone for 15 mins after deleting tons of stuff...
1. File size = 20,400; Outlook size (properties | folder size option) = 19,165
2. Closed all other apps but Outlook
3. Deleted enough stuff so the overall folder sizes totalled 9,447 (when using Outlook properties | folder size option)
4. Emptied Deleted Items folder
5. Left PC alone for ~20 minutes
6. PST file size went from 20,400 to 17,500 and was steadily shrinking right in front of my eyes

So there you have it Computer Forensics fans...Outlook DOES INDEED have an automatic compacting mechanism that kicks in if you have an idle system and Outlook is open and running.

Now if only I could find the disable value/key in the Registry (if it exists).

Thanks for the help Nihil.

If the files are actually deleted from the PST. That is they are not moved to the deleted items folder, say you use shift-detele in a PST, stopping compaction will not keep the email from being overwritting. Exchange will always write to white space first before growing the size of the PST.

Exchange server does the same thing on its databases. It is usually pretty common to see around 3-5GB of whitespace on an exchange store that is 25GB in total size, and has a lot of activity.

So I don't know how effective your data recovery would be. If there is a lot of mail being writting in and out of the PST I would expect that most things would be overwritten pretty quickly once they are deleted.

Quote:

---

So there you have it Computer Forensics fans...Outlook DOES INDEED have an automatic compacting mechanism that kicks in if you have an idle system and Outlook is open and running.

---

Now how the hell do you carry out a forensic examination on a pc that is running, at least one that will stand up in a court of law?

First off..Why the hell is this in the computer forensics forum? This has nothing to do with the topic.

Secondly, Jinxy: You use this: http://www.digitalintel.com/shadow.htm

hogfly

Quote:

---

First off..Why the hell is this in the computer forensics forum? This has nothing to do with the topic.

---

On the contrary, it has everything to do with forensics. The question is about whether the Outlook automatic maintenance routine will destroy forensic evidence or not. And, if it does, can this be prevented to permit accurate forensic analysis. I realise it wasn't worded quite like that, but that does seem to be the issue? so it is sort of "pre-forensics", with the ultimate objective being a reliable forensic analysis. In other words: "are forensics possible in these conditions?"

mohaugn

Quote:

---

If the files are actually deleted from the PST. That is they are not moved to the deleted items folder, say you use shift-detele in a PST, stopping compaction will not keep the email from being overwritting. Exchange will always write to white space first before growing the size of the PST.

---

That is an excellent point which I did mention in an earlier post. Actually, it does not matter if you use &lt;shift&gt; + &lt;delete&gt; or just send items to the deleted "folder" and then empty it (you can actually set an option to automatically empty the deleted items folder on exit). Both will create the same available (white) space, which the system will use.

Now, the "deleted items folder" does not exist :) The records are actually held in .pst. Only the archive has a separate folder. Whilst they are "flagged" as being in the deleted items folder, they are safe, and you can recover them using Outlook itself (it's a bit like the Recycle Bin). Once you reset this flag by emptying the deleted items folder, or set it directly by using &lt;shift&gt; + &lt;delete&gt; the space is available for use.

So a lot will depend on user usage patterns. If they go into Outlook, do their stuff then come out and go away, you would have a reasonable chance. If they keep going in and out of Outlook sessions, then the probability of overwriting is very high.

I see the whole dilemma as similar to the page/swap file, it is a dynamic and volatile environment rather than a static one. Sure, you can recover data from the page/swap file but what you get is very dependent on how the machine is being used.

For a really reliable result you need a physical solution such as hogfly has identified, or software that intercepts all e-mail and sends a BCC to another location. Both are "spying" so you need to make damn sure that you have the authority to do it :eek:

Well, those are my thoughts on it

Quote:

---

Originally posted here by nihil




On the contrary, it has everything to do with forensics. The question is about whether the Outlook automatic maintenance routine will destroy forensic evidence or not. And, if it does, can this be prevented to permit accurate forensic analysis. I realise it wasn't worded quite like that, but that does seem to be the issue? so it is sort of "pre-forensics", with the ultimate objective being a reliable forensic analysis. In other words: "are forensics possible in these conditions?"

---

Nihil, if this is a forensics issue then I weep for the credibility of anything produced from it. While compacting whitespace might be an issue, the system shouldn't even be live, and shouldn't be operated on, so the whole compacting issue is moot, because in a real investigation the system isn't going to be live unless someone is using something similar to shadow.

Now, that being said, you should be able to recover outlook files from an INFO2 file or the MFT itself. If it requires it, go get the slack space surrounding the pst file as well. and since it seems like some help is needed in this area...you could always fork out $200 bucks and buy this: http://www.paraben-forensics.com/examiner.html

Quote:

---

Originally posted here by hogfly
Nihil, if this is a forensics issue then I weep for the credibility of anything produced from it. While compacting whitespace might be an issue, the system shouldn't even be live, and shouldn't be operated on, so the whole compacting issue is moot, because in a real investigation the system isn't going to be live unless someone is using something similar to shadow.

---

You're right. As this discovery regarding how Outlook operates moves along it has become very apparent that 1) I wont be able to recover the data as expected and 2) wont hold up in court. That said, this issue might not be a court thing but if it turns into one than this evidence is worthless...big risk here of course.

Quote:

---

Now, that being said, you should be able to recover outlook files from an INFO2 file or the MFT itself. If it requires it, go get the slack space surrounding the pst file as well. and since it seems like some help is needed in this area...you could always fork out $200 bucks and buy this: http://www.paraben-forensics.com/examiner.html [/B]

---

Thanks for the reference...I'll take a look at this. I also like that Shadow box you sent earlier because in addition to the challenge of monitoring email, I have to monitor all traffic including web and a packet sniffer may be viable in this particular situation.

Thanks for all your tips and help (nihil, hogfly, mo, jinxy)!

Compaction apparently destroys the email so yes..when a pst is compacted, you lose the ability to recover the email.

here's a little tidbit from a mailing list.

1) Make a backup copy of the PST file being examined.
2) Using a hex editor that you are familiar with replace bytes 7 to 13
of the PST file with FF (they're usually set to 00).
3) Run a tool called "scanpst", which is usually resident in C:\Program
Files\Common Files\System\Mapi\1033 on a windows box. It might not be
in this directory, but should be installed by default.
4) Open the PST file and any recoverable messages should have been
recovered.

The location of scanpst depends on the version of your OS, and the version of Office. Scanpst was only included in windows95. If you are running any later OS than that you will have to have office installed on the system to have it installed, so it is not installed by default by the OS.


excerpt from- http://support.microsoft.com/default...b;en-us;197316

The Inbox Repair Tool ships with Microsoft Windows 95, and is also on both the Microsoft Outlook 98 and Microsoft Office 2000 CD-ROM. It is installed automatically during setup. This utility is also installed with the Windows Messaging Service Setup on the Microsoft Windows 98 CD-ROM. You can find these programs in the following folder:
&lt;CD drive&gt;:\tools\oldwin95\message\us\wms.exe

In Windows 2000, you can locate these programs in the following folder:
&lt;CD drive&gt;:\Program Files\Common Files\System\Mapi\1033\NT\Scanpst.exe

I don't think they meant installed by default as part of the OS, but rather by default as part of Outlook. So if Outlook is installed, I think they meant to imply it would be there. Just wanted to clarify that.
-hog