CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Convert the PST to an EDB file and mount it

  Why it's wrong here

  Converting a PST to EDB and mounting it is an Exchange migration technique, not a forensic recovery method. The conversion reads only the logically active items in the PST's node tree, leaving deleted items that no longer have directory entries untouched. Mounting the resulting EDB database presents a normalized mailbox view but does not scan or carve the PST's free space, so permanently deleted email remnants are never exposed.

• ✗

  Repair the PST file using Scanpst.exe

  Why it's wrong here

  Scanpst.exe is the Inbox Repair Tool; it rebuilds the PST's header, block allocation map, and B-tree indexes to resolve structural corruption such as bad CRCs or orphaned nodes. Its purpose is to restore logical consistency so Outlook will open the file again, not to perform data carving. Items that have been purged from any recoverable folder and whose directory entries were removed are not indexed, and Scanpst cannot reconstruct them from unallocated data blocks.

• ✗

  Reconstruct the PST from the Exchange server backup

  Why it's wrong here

  Reconstructing the PST from an Exchange server backup fails because the backup reflects the server mailbox state only as of the last backup time, and any deletions occurring after that point are absent. A PST is frequently a client-side archive or offline folder not fully synchronized with the server, so the Exchange database may never contain the same deleted items. This approach also bypasses the PST itself, so it cannot recover remnants unique to the PST file's slack or unallocated space.

• ✓

  Use a forensic tool to carve for deleted items within the PST

  Why this is correct

  Forensic carving scans the raw PST byte stream for known message property tags, signature patterns, and header structures that remain in unallocated blocks after logical deletion. Because deleting an item typically only marks its B-tree entries as free rather than scrubbing the underlying data, tools can reassemble deleted emails directly from the PST's free space and slack. This bypasses the file's logical index, which is exactly why it is the only listed option capable of recovering permanently deleted items.

Go deeper

Related to this question