The Judge's order also provided a specific set of instructions for searching for missing Outlook .PST files. Unfortunately, the Judge's statement to the EOP left a gaping loophole. Here's what he said:

When a user moves an e-mail to a personal folder, that e-mail is likely transferred from the network to a .PST file on that user's hard drive. It would remain there until deleted or destroyed, and would likely survive the replacement of the user's workstation.

Yeah, not so much. Let's look at Magistrate Judge Facciola's statement. This one's full of problematic assumptions:

• That the email messages originally stored in Notes databases were ever transfered to Exchange or Outlook to begin with (they may not have been);
• That users regularly move their inbox email or other messages from the Exchange server to local .PST files (somewhat unlikely for most users);
• That when a user changes PCs, the .PST files would be successfully moved (also somewhat unlikely).

We know from our OutlookPower users that when users move to a new PC, they often forget to look in their Documents and Settings folder to move either their active .PST files or the .PST archive files Outlook created. We get a never-ending stream of panicky emails from our readers because those files didn't survive the transition.

Frankly, this is a Microsoft problem as well, since Outlook should automatically store .PST files in My Documents, where users would be much more likely to back them up during their normal (if ever) backup process. Outlook doesn't work that way by default, so .PST files often get left behind when a user moves to a new PC.

Now, let's look at the Magistrate Judge's further statements regarding recovery of .PST files:

EOP is able to remotely query workstations on its network and copy .PST files located therein. Performing this function is within the capacity of the Office of the Chief Information Officer ("OCIO"), and thus would not require outsourcing or a long procurement process.

Moreover, it appears that this process can be automated, reducing labor costs -- and, in fact, it can be executed in such a way as to cause no disruption to, and require no affirmative action by, EOP employees.

This process is so not forensically sound. First, while remote PC management is common in larger enterprises, the responder on each PC must be turned on to speak to the network management program. If I wanted to hide a PC from discovery, I'd simply turn off that responder while running the query. Suddenly, no incriminated emails would be found.

Second, old Outlook .PST files aren't always where you think they're going to be. Many users (myself included) move the .PST file out of the Document and Settings folder, or keep older backup copies in other locations. A remote scan would not find these files.