A probabilistic process to determine the owner of an electronic file, such as a Personal Store (.pst). A weighted analysis of multiple factors is performed including the operating system file owner, a user running the process, a "top Y most frequently occurring addresses" when analyzing "X number of sent then received messages," and a number of occurrences of each "top Y most frequently occurring address." Other factors, such as the ability to resolve against a directory service may be used. Each of the "top Y most frequently occurring addresses" is analyzed to calculate its weight according to a predetermined relationship and the address is compared to the operating system file owner and a logged-on user value. If there is a match, that value is returned as the probable owner of the file.