In an email crime investigation, the forensic investigator analyses a computer using the Microsoft Outlook application. The investigator knows that Outlook stores email data in both .pst and .ost file formats. They want to focus on the files that hold the email data even when there is no internet connection. Which files should the investigator target for a deeper analysis?
In an email crime investigation focusing on email data accessible without an internet connection, the investigator should target Offline Storage Table (.ost) files. These files store a local copy of the email data from an Exchange server and are accessible even when the computer is offline. These .ost files are typically located at C:\Users\%USERNAME%\AppData\Local\Microsoft\Outlook.
A < https://www.techtarget.com/whatis/definition/OST-file-ost#:~:text=OST%20stands%20for%20Offline%20Storage,view%20emails%20online%20or%20offline.
As emails, contact, calendar, and other data are not taken off the server such as pop accounts, users can access their emails even when they do not have an Internet connection. All mailbox information is updated when the connection is revived.
CHFIv11 page1193: "...users can access...do not have an Internet connection"