Start a conversation

Dates of Exported PST Files

Dates of Exported PST Files

When exporting PST files the Content Created and Content Last Modified dates will change.

The sent and received dates of email messages are actually stored in the email header and copied over unchanged.  To carry across the PST-specific modified and created dates would be misleading as you may be importing email from PST, NSF, DBX and Mbox.  Some of these formats don't actually have that metadata.  Therefore, the modified and created dates always relate to the time of exporting and are independent of any dates in the original evidence data.

The solution for this is the export report: it contains all original dates from the evidence data.

Another way to look at this is to compare a PST file to a file system.  When you export a file, the copy you create has its own file system metadata, such as date, owner, location, etc. The same happens when you copy an email to a PST: the PST-specific metadata is independent of the source data.

The export report is a more robust mechanism for transferring the original dates of exported files.   Intella cannot guarantee the accuracy of these dates in the generated PST due to the access of exported files changing these dates.  The export report will also prevent you from worrying about NTFS dates being translated with loss of information to FAT, etc. 

Choose files or drag and drop files
Was this article helpful?
Yes
No
  1. Jessica Stevens (Migrated deleted Agent)

  2. Posted
  3. Updated

Comments