I am familiar with the process of recovering deleted files or folders from a .pst file by purposefully corrupting the PST file by deleting positions 7 - 13 with a hex editor, and then running SCANPST.exe to repair the file. During the SCANPST repair the PST recovery tool operates in an unbiased fashion returning all recognizable files whether deleted purposefully or as result of corruption. My question is related to whether or not the process is affected by copying the file to a different drive prior to performing this process. My limited understanding of the process is that the reason you can recover these files is that upon deletion what is really happening on the hard drive is that the space taken up by these files is flagged as available again to be overwritten. Until however that specific memory space if overwritten the contents still exists. I am working on a copy of a users PST file that has been copied and sent to me. The process worked and recovered some of the data, but much is missing. I am wondering if the process was run directly on the remote users PC if more data could be recovered. I guess my real question is weather or not all data contained in the memory space that is now flagged on the hard drive as available again, would be picked up by the copy process when teh PST was sent to me. Since some data was recovered I would think the answer is yes, but much is missing and I really dont know exactly how that process works.
Thanks in advance for any advice you can give. I appreciate it. Have a super day.