www.cloudninediscovery.com

Subscription Center

Sign up to receive eDiscovery Daily's articles via email or add the RSS feed to your newsreader of choice.

  • RSS Feed

Library

Browse eDiscovery Daily Blog

About the Bloggers

Brad Jenkins

Brad Jenkins, President and CEO of CloudNine Discovery, has over 20 years of experience leading customer focused companies in the litigation support arena. Brad has authored many articles on litigation support issues, and has spoken before national audiences on document management practices and solutions.

Doug Austin

Doug Austin, Professional Services Manager for CloudNine Discovery, has over 20 years experience providing legal technology consulting and technical project management services to numerous commercial and government clients. Doug has also authored several articles on eDiscovery best practices.

Jane Gennarelli

Jane Gennarelli is a principal of Magellan’s Law Corporation and has been assisting litigators in effectively handling discovery materials for over 30 years. She authored the company’s Best Practices in a Box™ content product and assists firms in applying technology to document handling tasks. She is a known expert and often does webinars and presentations for litigation support professionals around the country. Jane can be reached by email at jane@litigationbestpractices.com.

eDiscovery Best Practices: Repairing a Corrupted Outlook PST File

September 11, 2012

By Doug Austin

 

We like to believe that there will never be any problems with the data that we preserve, collect and process for eDiscovery purposes.  Sometimes, however, critical data may be difficult or impossible to use.  Perhaps key files are password protected from being opened and the only way to open them is to “crack” the password.  Or, perhaps a key file may be corrupted.  If that file is an Outlook Personal Storage Table (PST) file, that file corruption could literally make tens of thousands of documents unavailable for discovery unless the file can be repaired.

I recently had a case where 40% of the collection was contained in 2 corrupt Outlook PST files.  Had we not been able to repair those files, we would have been unable to access nearly half of the collection that needed to be reviewed for responsiveness in the case.

Fortunately, there is a repair tool for Outlook designed to repair corrupted PST files.  It’s called SCANPST.EXE.  It’s an official repair tool that is included in Office 2010 (as well as Office 2007 before it).  As a very useful utility, you might think that SCANPST would be located in the Microsoft Office 2010 Tools folder within the Microsoft Office folder in Program files.  But, you’d be wrong.  Instead, you’ll have to open Windows Explorer and navigate to the C:\Program Files\Microsoft Office\Office14 folder (for Office 2010, at least) to find the SCANPST.EXE utility.

Double-click this file to open Microsoft Outlook Inbox Repair Tool.  The utility will prompt for the path and name of the PST file (with a Browse button to browse to the corrupted PST file).  There is also an Options button to enable you to log activity to a new log file, append to an existing log file or choose not to write to a log file.  Before you start, you’ll need to close Outlook and all mail-enabled applications. 

Once ready, press the Start button and the application will begin checking for errors. When the process is complete, it should indicate that it found errors on the corrupted PST file, along with a count of folders and items found in the file.  The utility will also provide a check box to make a backup of the scanned file before repairing.  ALWAYS make a backup – you never know what might happen during the repair process.  Click the Repair button when ready and the utility will hopefully repair the corrupted PST file.

If SCANPST.EXE fails to repair the file, then there are some third party utilities available that may succeed where SCANPST failed.  If all else fails, you can hire a data recovery expert, but that can get very expensive.  Hopefully, you don’t have to resort to that.

By repairing the PST file, you are technically changing the file, so if the PST file is discoverable, it will probably be necessary to disclose the corruption to opposing counsel and the intent to attempt to repair the file to avoid potential spoliation claims.

So, what do you think?  Have you encountered corrupted PST files in discovery?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
http://www.cloudninediscovery.com/ondemand/free-software-trial.aspx

Comments

  • October 02, 2012 recover deleted pst file

    If your .PST files are no longer in the Recycle Bin, you could try with NTFS Undelete.When you delete a file, its content physically remains intact on the media, but the occupied space becomes marked as free. Next file saved to the disk may overwrite the contents of the deleted file. Recovery software is suitable option for it.

  • September 11, 2012 Doug Austin

    Good point, Craig. Before Microsoft added the Recover Deleted Items functionality in Outlook 2007, I used the intentionally corrupt method of recovering deleted items in a PST for a couple of clients, including one who had to let an employee go and then found he had deleted all of his emails before he left (but apparently did not know to compact the PST after doing so). Needless to say, we discovered some eye-opening stuff after intentionally corrupting his PST and 'repairing' it.

  • September 11, 2012 Craig Ball

    You might be interested to know that it used to be common practice in computer forensics to intentionally corrupt bytes 7-13 of a PST as a means to recover double-deleted files in the PST that hadn't been flushed out by compaction. Accordingly, users who repair corrupted PSTs may be surprised to recover messages that the user hasn't seen for some time and thought were gone.

What Do You Think?

Please comment on the above article.

Name (required)
Email Address (required, but won’t be published)
Web Address (optional) Remember My Information
TypeKey/TypePad Login (optional)