Chapter 11. Parsing Outlook PST Containers

Electronic mail (e-mail) has been one of the most popular forms of communication on electronic devices. E-mails can be sent from computers, websites, and the phones in so many pockets across the globe. This medium allows for the transmission of information in the form of text, HTML, attachments, and more in a reliable fashion. It is no wonder then, that e-mails can play a large part in investigations, especially for cases involving the workplace. In this chapter, we are going to work with a common e-mail format, Personal Storage Table (PST), used by Microsoft Outlook to store e-mail content in a single file.

The following script introduces us to a series of operations available via the libpff library developed ...

Get Learning Python for Forensics now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.