The reason he was on Reddit asking how to strip the to & from lines from .pst archives is because no such commercially available tool exists to complete the task. It does not exist because such a tool has no legitimate purpose in the real world! The only reason someone would need such a tool is conceal potential incriminating evidence. IT guys do not seek this type of information for their day to day jobs duties... ever! This is a very specific task, one so obscure, so unethical, it would only be done under direction of a client. This is intent.
Yea sure, maybe they deleted archives due to their ineptness at records retention, but stripping header lines has no other purpose than to intentionally obfuscate and obstruct discovery. Deleting his Reddit history was just icing on the cake.
-johnfrank
* * *