Install this skill

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Framework mappings

Overview

Microsoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.

When to Use

When investigating security incidents that require analyzing outlook pst for email forensics
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

libpff/pffexport (open-source PST parser)
Python 3.8+ with pypff or libratom libraries
MailXaminer, Forensic Email Collector, or SysTools PST Forensics (commercial)
Microsoft Outlook (optional, for native PST access)
Sufficient disk space for extracted content

PST File Locations

Source	Path
Outlook 2016+ Default	%USERPROFILE%\Documents\Outlook Files*.pst
Outlook Legacy	%LOCALAPPDATA%\Microsoft\Outlook*.pst
OST Cache	%LOCALAPPDATA%\Microsoft\Outlook*.ost
Archive	%USERPROFILE%\Documents\Outlook Files\archive.pst

Analysis with Open-Source Tools

libpff / pffexport

# Export all items from PST file
pffexport -m all evidence.pst -t exported_pst
 
# Export only email messages
pffexport -m items evidence.pst -t exported_emails
 
# Export recovered/deleted items
pffexport -m recovered evidence.pst -t recovered_items
 
# Get PST file information
pffinfo evidence.pst

Python PST Analysis

import pypff
import os
import json
import hashlib
import email
import sys
from datetime import datetime
from collections import defaultdict
 
 
class PSTForensicAnalyzer:
    """Forensic analysis of Outlook PST/OST files."""
 
    def __init__(self, pst_path: str, output_dir: str):
        self.pst_path = pst_path
        self.output_dir = output_dir
        os.makedirs(output_dir, exist_ok=True)
        self.pst = pypff.file()
        self.pst.open(pst_path)
        self.messages = []
        self.attachments = []
        self.stats = defaultdict(int)
 
    def process_folder(self, folder, folder_path: str = ""):
        """Recursively process PST folders and extract messages."""
        folder_name = folder.name or "Root"
        current_path = f"{folder_path}/{folder_name}" if folder_path else folder_name
 
        for i in range(folder.number_of_sub_messages):
            try:
                message = folder.get_sub_message(i)
                msg_data = self.extract_message(message, current_path)
                if msg_data:
                    self.messages.append(msg_data)
                    self.stats["total_messages"] += 1
            except Exception as e:
                self.stats["parse_errors"] += 1
 
        for i in range(folder.number_of_sub_folders):
            try:
                subfolder = folder.get_sub_folder(i)
                self.process_folder(subfolder, current_path)
            except Exception:
                continue
 
    def extract_message(self, message, folder_path: str) -> dict:
        """Extract forensic metadata from a single email message."""
        msg_data = {
            "folder": folder_path,
            "subject": message.subject or "",
            "sender": message.sender_name or "",
            "sender_email": "",
            "creation_time": str(message.creation_time) if message.creation_time else None,
            "delivery_time": str(message.delivery_time) if message.delivery_time else None,
            "modification_time": str(message.modification_time) if message.modification_time else None,
            "has_attachments": message.number_of_attachments > 0,
            "attachment_count": message.number_of_attachments,
            "body_size": len(message.plain_text_body or b""),
            "html_size": len(message.html_body or b""),
        }
 
        # Extract transport headers for routing analysis
        headers = message.transport_headers
        if headers:
            msg_data["headers_present"] = True
            msg_data["headers_size"] = len(headers)
            # Parse key headers
            parsed = email.message_from_string(headers)
            msg_data["from_header"] = parsed.get("From", "")
            msg_data["to_header"] = parsed.get("To", "")
            msg_data["date_header"] = parsed.get("Date", "")
            msg_data["message_id"] = parsed.get("Message-ID", "")
            msg_data["x_originating_ip"] = parsed.get("X-Originating-IP", "")
            msg_data["received_headers"] = parsed.get_all("Received", [])
 
        # Process attachments
        for j in range(message.number_of_attachments):
            try:
                attachment = message.get_attachment(j)
                att_data = {
                    "message_subject": msg_data["subject"],
                    "name": attachment.name or f"attachment_{j}",
                    "size": attachment.size,
                    "content_type": "",
                }
                self.attachments.append(att_data)
                self.stats["total_attachments"] += 1
            except Exception:
                continue
 
        return msg_data
 
    def save_attachments(self, max_size_mb: int = 100):
        """Export attachments to disk for analysis."""
        att_dir = os.path.join(self.output_dir, "attachments")
        os.makedirs(att_dir, exist_ok=True)
 
        root = self.pst.get_root_folder()
        self._save_attachments_recursive(root, att_dir, max_size_mb)
 
    def _save_attachments_recursive(self, folder, att_dir, max_size_mb):
        for i in range(folder.number_of_sub_messages):
            try:
                message = folder.get_sub_message(i)
                for j in range(message.number_of_attachments):
                    att = message.get_attachment(j)
                    if att.size and att.size < max_size_mb * 1024 * 1024:
                        name = att.name or f"unknown_{i}_{j}"
                        safe_name = "".join(c if c.isalnum() or c in ".-_" else "_" for c in name)
                        path = os.path.join(att_dir, safe_name)
                        try:
                            data = att.read_buffer(att.size)
                            with open(path, "wb") as f:
                                f.write(data)
                        except Exception:
                            continue
            except Exception:
                continue
 
        for i in range(folder.number_of_sub_folders):
            try:
                self._save_attachments_recursive(folder.get_sub_folder(i), att_dir, max_size_mb)
            except Exception:
                continue
 
    def generate_report(self) -> str:
        """Generate comprehensive PST forensic analysis report."""
        root = self.pst.get_root_folder()
        self.process_folder(root)
 
        report = {
            "analysis_timestamp": datetime.now().isoformat(),
            "pst_file": self.pst_path,
            "pst_size_bytes": os.path.getsize(self.pst_path),
            "statistics": dict(self.stats),
            "messages": self.messages[:500],
            "attachments": self.attachments[:200],
        }
 
        report_path = os.path.join(self.output_dir, "pst_forensic_report.json")
        with open(report_path, "w") as f:
            json.dump(report, f, indent=2, default=str)
 
        print(f"[*] Total messages: {self.stats['total_messages']}")
        print(f"[*] Total attachments: {self.stats['total_attachments']}")
        print(f"[*] Parse errors: {self.stats['parse_errors']}")
        return report_path
 
    def close(self):
        self.pst.close()
 
 
def main():
    if len(sys.argv) < 3:
        print("Usage: python process.py <pst_file> <output_dir>")
        sys.exit(1)
    analyzer = PSTForensicAnalyzer(sys.argv[1], sys.argv[2])
    analyzer.generate_report()
    analyzer.close()
 
 
if __name__ == "__main__":
    main()

Email Header Analysis

Key headers for forensic investigation:

Header	Forensic Value
Received	Message routing chain (read bottom to top)
X-Originating-IP	Sender's actual IP address
Message-ID	Unique identifier for correlation
Date	Send timestamp
Return-Path	Bounce address (may differ from From)
DKIM-Signature	Domain authentication signature
Authentication-Results	SPF, DKIM, DMARC verification results
X-Mailer	Email client used

References

MailXaminer PST Forensics: https://www.mailxaminer.com/blog/outlook-pst-file-forensics/
libpff Documentation: https://github.com/libyal/libpff
PST File Format Specification: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-pst/
SANS Email Forensics: https://www.sans.org/blog/email-forensics/

Example Output

$ pffexport /evidence/jsmith_archive.pst -t /analysis/pst_output
 
pffexport 20231205 - libpff PST/OST Export Tool
=================================================
Input: /evidence/jsmith_archive.pst (2.3 GB)
 
Exporting PST contents...
  Folders:       45
  Messages:      12,456
  Attachments:   3,234
  Contacts:      567
  Calendar:      234
  Tasks:         89
 
Export completed in 3m 42s.
 
$ python3 pst_analyzer.py /analysis/pst_output /analysis/email_report
 
PST Forensic Analysis Report
==============================
Source: jsmith_archive.pst (john.smith@corporate.com)
Date Range: 2023-06-01 to 2024-01-18
 
--- Mailbox Statistics ---
  Total Emails:       12,456
  Sent:               4,567
  Received:           7,889
  With Attachments:   3,234
  Deleted (recovered): 234
 
--- Phishing / Suspicious Emails ---
Email #8923
  Date:        2024-01-15 14:30:22 UTC
  From:        "IT Support" <it-support@c0rporate-help.com>
  To:          john.smith@corporate.com
  Subject:     Urgent: Password Reset Required
  Headers:
    Return-Path:    bounce@mail-relay.c0rporate-help.com
    X-Originating-IP: 203.0.113.55
    Received:       from mail-relay.c0rporate-help.com (203.0.113.55)
    SPF:            FAIL (domain c0rporate-help.com)
    DKIM:           NONE
    DMARC:          FAIL
  Attachments:
    - Password_Reset_Form.xlsm (245 KB) SHA-256: 7a3b8c9d...e1f2a3b4
  Body Preview:  "Dear Employee, Your password will expire in 24 hours.
                  Please open the attached form to reset your credentials..."
 
--- Data Exfiltration Indicators ---
Email #9102
  Date:        2024-01-16 03:15:45 UTC
  From:        john.smith@corporate.com
  To:          j.smith.personal8842@protonmail.com
  Subject:     (no subject)
  Attachments:
    - archive_part1.7z (24.5 MB) - encrypted
    - archive_part2.7z (24.5 MB) - encrypted
 
Email #9103
  Date:        2024-01-16 03:18:22 UTC
  From:        john.smith@corporate.com
  To:          j.smith.personal8842@protonmail.com
  Subject:     Re:
  Attachments:
    - archive_part3.7z (18.2 MB) - encrypted
 
--- Keyword Hits ---
  "confidential":     45 emails
  "password":         23 emails
  "transfer":         12 emails
  "resign":           3 emails
  "delete evidence":  1 email (Email #9200, 2024-01-17 22:30:00 UTC)
 
Summary:
  Phishing emails detected:    1 (initial compromise vector)
  Suspicious sent emails:      5 (to personal accounts with attachments)
  Encrypted attachments:       3 (67.2 MB total - possible exfiltration)
  Report: /analysis/email_report/pst_forensic_report.json

Source materials

References and resources

Everything below is rendered for inspection. Script files are read-only and never run.

References 3

api-reference.md2.5 KB

API Reference: Outlook PST Email Forensics

pypff (libpff Python bindings)

Installation

pip install libpff-python

Opening a PST File

import pypff
 
pst = pypff.file()
pst.open("mailbox.pst")
root = pst.get_root_folder()

Navigating Folders

for i in range(root.number_of_sub_folders):
    folder = root.get_sub_folder(i)
    print(f"{folder.name}: {folder.number_of_sub_messages} messages")

Extracting Messages

msg = folder.get_sub_message(0)
print(msg.subject)
print(msg.sender_name)
print(msg.delivery_time)
print(msg.transport_headers)
print(msg.plain_text_body)
print(msg.html_body)

Extracting Attachments

for i in range(msg.number_of_attachments):
    att = msg.get_attachment(i)
    print(f"Name: {att.name}, Size: {att.size}")
    data = att.read_buffer(att.size)

pffexport (CLI)

Syntax

pffexport mailbox.pst                    # Export all to current dir
pffexport -m all mailbox.pst             # Export all message types
pffexport -t target_dir mailbox.pst      # Export to target directory
pffexport -f text mailbox.pst            # Export as text format

Output Structure

Export/
  Inbox/
    Message001/
      Message.txt
      Attachment001.pdf
  Sent Items/
  Deleted Items/

readpst (libpst)

Syntax

readpst -o output_dir mailbox.pst        # Extract to dir
readpst -e mailbox.pst                   # Extract attachments
readpst -r mailbox.pst                   # Recursive extraction
readpst -j 4 mailbox.pst                # Parallel (4 threads)
readpst -S mailbox.pst                   # Separate files per message

PST File Structure

Component	Description
NDB Layer	Node Database - raw data storage
LTP Layer	Lists/Tables/Properties - message properties
Messaging Layer	Folders, messages, attachments

Key Message Properties

Property	MAPI Tag	Description
Subject	PR_SUBJECT (0x0037)	Email subject
Sender	PR_SENDER_NAME (0x0C1A)	Sender display name
From	PR_SENT_REPRESENTING_EMAIL (0x0065)	Sender email
Delivery Time	PR_MESSAGE_DELIVERY_TIME (0x0E06)	When delivered
Headers	PR_TRANSPORT_MESSAGE_HEADERS (0x007D)	Full SMTP headers

Forensic Considerations

Deleted Items folder may contain evidence
Recoverable Items (dumpster) requires special extraction
Calendar/Contacts may contain relevant data
Journal entries can provide timeline evidence

standards.md0.6 KB

Standards - Outlook PST Email Forensics

Standards

MS-PST: Outlook Personal Folders (.pst) File Format
MS-OXMSG: Outlook Item Message File Format
NIST SP 800-86: Guide to Integrating Forensic Techniques

Tools

libpff/pffexport: Open-source PST parser
pypff (Python): Python bindings for libpff
MailXaminer: Commercial email forensics
PST Walker: Email investigation software
Kernel Outlook PST Viewer: Free PST reader

Key Artifacts

Email headers (Received, X-Originating-IP, Message-ID)
Deleted items (Recoverable Items folder)
Attachments (malware, exfiltrated data)
Calendar events, contacts, tasks

workflows.md0.4 KB

Workflows - PST Email Forensics

Workflow: Email Evidence Extraction

Acquire PST/OST files from evidence
    |
Hash original files (SHA-256)
    |
Export with pffexport (items + recovered)
    |
Parse email headers for routing
    |
Extract and hash attachments
    |
Search for keywords across messages
    |
Build communication timeline
    |
Document findings with chain of custody

Scripts 1

agent.py5.9 KB

Display-only source. This catalog never executes bundled scripts.

#!/usr/bin/env python3
"""Outlook PST file forensic analysis agent.

Parses PST/OST files using pypff (libpff) to extract emails, attachments,
metadata, and deleted items for forensic investigation.
"""

import os
import sys
import json
import hashlib
import re

try:
    import pypff
    HAS_PYPFF = True
except ImportError:
    HAS_PYPFF = False


def compute_hash(filepath):
    sha256 = hashlib.sha256()
    with open(filepath, "rb") as f:
        for chunk in iter(lambda: f.read(65536), b""):
            sha256.update(chunk)
    return sha256.hexdigest()


def open_pst(filepath):
    if not HAS_PYPFF:
        return None, "pypff not installed. pip install libpff-python"
    pst = pypff.file()
    pst.open(filepath)
    return pst, None


def extract_messages(folder, max_messages=1000):
    messages = []
    for i in range(min(folder.number_of_sub_messages, max_messages)):
        msg = folder.get_sub_message(i)
        entry = {
            "subject": msg.subject or "",
            "sender": msg.sender_name or "",
            "headers": (msg.transport_headers or "")[:500],
            "creation_time": str(msg.creation_time) if msg.creation_time else "",
            "delivery_time": str(msg.delivery_time) if msg.delivery_time else "",
            "has_attachments": msg.number_of_attachments > 0,
            "attachment_count": msg.number_of_attachments,
            "body_size": len(msg.plain_text_body or "") if msg.plain_text_body else 0,
        }
        # Extract attachment metadata
        attachments = []
        for j in range(msg.number_of_attachments):
            att = msg.get_attachment(j)
            attachments.append({
                "name": att.name or f"attachment_{j}",
                "size": att.size,
            })
        entry["attachments"] = attachments
        messages.append(entry)
    return messages


def walk_folders(folder, path="", results=None):
    if results is None:
        results = []
    current_path = f"{path}/{folder.name}" if folder.name else path or "/Root"
    messages = extract_messages(folder)
    if messages:
        results.append({
            "folder": current_path,
            "message_count": len(messages),
            "messages": messages,
        })
    for i in range(folder.number_of_sub_folders):
        subfolder = folder.get_sub_folder(i)
        walk_folders(subfolder, current_path, results)
    return results


def extract_email_addresses(messages):
    addresses = set()
    email_pattern = re.compile(r"[\w.+-]+@[\w-]+\.[\w.-]+")
    for msg in messages:
        for field in [msg.get("sender", ""), msg.get("headers", "")]:
            addresses.update(email_pattern.findall(field))
    return sorted(addresses)


def detect_suspicious_emails(messages):
    findings = []
    suspicious_exts = [".exe", ".scr", ".bat", ".cmd", ".ps1", ".vbs",
                       ".js", ".hta", ".lnk", ".iso", ".img"]
    for msg in messages:
        for att in msg.get("attachments", []):
            name = (att.get("name") or "").lower()
            for ext in suspicious_exts:
                if name.endswith(ext):
                    findings.append({
                        "type": "suspicious_attachment",
                        "subject": msg.get("subject", "")[:80],
                        "attachment": att.get("name"),
                        "extension": ext,
                        "severity": "HIGH",
                    })
        subject = (msg.get("subject") or "").lower()
        urgency_words = ["urgent", "immediate action", "password expired",
                         "verify your account", "suspended", "click here"]
        for word in urgency_words:
            if word in subject:
                findings.append({
                    "type": "phishing_indicator",
                    "subject": msg.get("subject", "")[:80],
                    "keyword": word,
                    "severity": "MEDIUM",
                })
                break
    return findings


def generate_report(filepath, folder_data):
    all_messages = []
    for fd in folder_data:
        all_messages.extend(fd.get("messages", []))
    addresses = extract_email_addresses(all_messages)
    suspicious = detect_suspicious_emails(all_messages)
    return {
        "file": filepath,
        "sha256": compute_hash(filepath),
        "size": os.path.getsize(filepath),
        "total_folders": len(folder_data),
        "total_messages": len(all_messages),
        "unique_addresses": len(addresses),
        "top_addresses": addresses[:20],
        "suspicious_findings": suspicious,
        "folders": [{
            "path": f["folder"],
            "count": f["message_count"],
        } for f in folder_data],
    }


if __name__ == "__main__":
    print("=" * 60)
    print("Outlook PST Forensic Analysis Agent")
    print("Email extraction, attachment analysis, phishing detection")
    print("=" * 60)

    target = sys.argv[1] if len(sys.argv) > 1 else None
    if not target or not os.path.exists(target):
        print("\n[DEMO] Usage: python agent.py <mailbox.pst>")
        print(f"  pypff available: {HAS_PYPFF}")
        sys.exit(0)

    pst, err = open_pst(target)
    if err:
        print(f"[!] {err}")
        sys.exit(1)

    print(f"\n[*] Parsing: {target}")
    root = pst.get_root_folder()
    folder_data = walk_folders(root)
    report = generate_report(target, folder_data)

    print(f"[*] Folders: {report['total_folders']}")
    print(f"[*] Messages: {report['total_messages']}")
    print(f"[*] Unique addresses: {report['unique_addresses']}")

    print("\n--- Folder Structure ---")
    for f in report["folders"]:
        print(f"  {f['path']}: {f['count']} messages")

    print(f"\n--- Suspicious ({len(report['suspicious_findings'])}) ---")
    for s in report["suspicious_findings"][:10]:
        print(f"  [{s['severity']}] {s['type']}: {s.get('attachment', s.get('keyword', ''))}")

    pst.close()
    print(f"\n{json.dumps(report, indent=2, default=str)}")

Keep exploring

MITRE ATT&CK

NIST CSF 2.0

NIST AI RMF

Overview

When to Use

Prerequisites

PST File Locations

Analysis with Open-Source Tools

libpff / pffexport

Python PST Analysis

Email Header Analysis

References

Example Output

References and resources

References 3

API Reference: Outlook PST Email Forensics

pypff (libpff Python bindings)

Installation

Opening a PST File

Navigating Folders

Extracting Messages

Extracting Attachments

pffexport (CLI)

Syntax

Output Structure

readpst (libpst)

Syntax

PST File Structure

Key Message Properties

Forensic Considerations

Standards - Outlook PST Email Forensics

Standards

Tools

Key Artifacts

Workflows - PST Email Forensics

Workflow: Email Evidence Extraction

Scripts 1

Related skills