When emails from a PST file are exported to PST format and then indexed in an Intella case, the Content Created and Content Last Modified dates for the emails in the exported PST file will not match the dates for the original PST file. This happens because the sent and received dates for the email messages within the exported PST file are stored in the email header and remain unchanged, but the modified and created dates apply to the newly created exported PST file.
Due to the different email formats, copying PST-specific modified and created dates can be misleading as not all email formats have that metadata. Therefore, the modified and created dates in Intella always relate to the time of exporting and are independent of any dates in the original evidence data.
If you want to report on the dates for the original PST file, you can use the Export Report feature to generate a report for the original PST file, which will accurately reflect the original dates.
The exported PST file can be compared to a file system, where the copy created has its metadata, including dates, owner, and location. Similarly, Exporting an email to a PST file using Intella creates a new PST file, and the PST-specific metadata is independent of the source data. As it is not guaranteed that the exported PST file will retain the accuracy of the original dates, the export report is a more reliable mechanism to transfer original dates. The export report also protects you from losing information caused by translation of NTFS dates to FAT dates, among others.
Updated April 2023