Search for Evidence Inside PST Files Without Outlook
A user’s Outlook data for IMAP, POP3 and web-based mail accounts is stored in Microsoft Outlook PST file which holds a B-tree structure with nodes & leaves to show folders & items within the folders. Custodian Outlook PST email files have three basic parts to be analyzed i.e. headers, body & attachments for evidence preservation.
Carl Wilson: Reporting 24X7 from HOLLADAY
Carl Wilson | May 18, 2015 | 12:15:10
And it was 21st time during this month when the LIVE CHAT panel popped up with a query that stated, “Looking for a solution to perform search inside the PST files without having Outlook installed. Please help”. So, here goes the most preferable solution (Always love to figure out some time for my clients from my busy schedule! ). The solution postulated can come up with use to digital forensic investigators, attorneys, law enforcement agencies and even to the corporate administrators too.
For forensic investigators, it is not always possible to have Outlook installed on the machine as an additional obligation, but the need to investigate or peep into Outlook PST files can come up anytime and anywhere.
The solution suggested: –
For analyzing the Live Exchange Server mailbox data, the most appropriate solution available till this date is MailXaminer. The tool can be used to search evidence inside PST files without Outlook. Make sure that the evidence PST file has been exported to the same machine, on which the software exists.
NOTE: – If you don’t have the software installed, then you can get it by placing an order from the following section: –
For the demo version, to get an insight into the tool, contact at: –
MailXaminer is a reliable Digital Forensics Investigation Tool which allows searching inside the PST file without Microsoft Outlook Email Client. It provides the following features:
- It provides multiple email view for the Forensic Analysis of damaged, password protected & healthy PST files.
- Dig into PST file & search for the evidence by using specific keywords and various search algorithms.
- It allows to Filter duplicate items while exporting analyzed data in the required file format and create an evidence list with bookmarked selected emails & attachments.
To search inside PST files without Outlook, Launch MailXaminer and follow the steps given below to perform the search operation.
Step 1: Case Mangement
Proceed either with the option of Create New Case, Open Recent Case or Import Case to manage the case in the MailXaminer
Step 2: Add PST file
Under the Scan File pop up, select Microsoft Outlook (*.pst) option and browse the suspect PST data file to add it into the MailXaminer. Otherwise, click on the Add Evidence option and select Microsoft Outlook (*.pst) to add the pst file
NOTE: – To open this PST file or to perform any kind of operation on it, in no manner, installation of Microsoft Outlook is required. BINGO!
Step 3: Search Option In MailXaminer
After getting the evidence PST file scanned and traversed, click on the Search option that is available in the left menu panel. After clicking on the Search option, select either General or Proximity search from the search panel.
Step 4: Use Search Criteria
Use Add Criteria Option and Logic Operators such as AND, OR, NOT to filter the search result more accurately.
Step 5: Advance Search Operation in MailXaminer
For advanced forensic search inside PST file without Outlook, investigators can also use sophisticated algorithms such as General Search, Wildcard Search, Fuzzy Search, Stem Search, and Regular Expression Search.
With more exploration of the available features, techies can search inside the PST files that too without having Microsoft Outlook installed.
Considering the rising need of performing the search within PST files in a standalone mode, replacing Outlook with a solution like MailXaminer proves more proficient and suitable. The application not only lets you have access to the PST but also perform a variety of searches on the data file for carving out evidence in a more detailed manner.
Carl Wilson, signing off for the day.
Have more queries? Do let us know. For more contact options, please visit: –