Outlook OST/PST — Email Data Files

Outlook OST and PST files are among the richest forensic artifacts on a Windows system — they contain complete email archives including messages with full headers, file attachments, calendar entries, contacts, and tasks. A single PST file can contain years of communication history, making it the primary evidence source in business email compromise, insider threat, and intellectual property theft investigations.

What Are Outlook OST/PST Files?

Microsoft Outlook stores email data in two file formats: OST (Offline Storage Table) files are local caches of Exchange/Office 365 mailboxes that synchronize with the server, while PST (Personal Storage Table) files are standalone portable archives that exist independently of any server. Both use the Microsoft Personal Folders File format documented in the MS-PST specification, a proprietary MAPI-based compound file structure with B-tree indexing.

OST files are automatically created when Outlook connects to an Exchange or Office 365 mailbox in Cached Exchange Mode. They mirror the server mailbox contents and are recreated if deleted. PST files are user-created archives that can be attached to any Outlook profile and transported between systems. In forensic investigations, PST files are frequently found on USB drives, personal cloud storage, and departing-employee laptops — often containing exported copies of corporate email that should not have left the organization.

Both formats store complete MAPI message objects including full RFC 5322 headers (From, To, CC, BCC, Message-ID, Received chains), HTML/RTF/plaintext message bodies, file attachments with original filenames, calendar appointments with attendee lists, contact records, task items, and journal entries. Deleted items remain in the “Deleted Items” folder or in the recoverable items dumpster until purged.

Location & Format

Format Details

What It Reveals

• Complete email communications — Every sent, received, and drafted message with full headers, bodies, and attachments.
• Email headers for attribution — Full RFC 5322 headers including Received chains, Message-ID, X-headers, and SPF/DKIM results for phishing analysis.
• File attachments — Original attachments with filenames, MIME types, and sizes; extractable from the PST/OST for malware analysis or document review.
• Deleted messages — Items in the Deleted Items folder or recoverable items dumpster; may contain evidence the user attempted to destroy.
• Calendar entries — Meeting invitations, appointments, and attendee responses revealing scheduling and coordination patterns.
• Contact records — Address book entries with phone numbers, email addresses, and notes.
• Folder structure — User-created folder hierarchy reveals organizational patterns and subject-matter categorization.
• PST creation/modification timestamps — File system timestamps on PST files reveal when archives were created or last accessed.

Forensic Use Cases

1. Business Email Compromise (BEC) Investigation

A CFO receives a wire transfer request from a compromised vendor email account. The OST file contains the original phishing email with full headers showing the actual sending infrastructure (IP addresses in Received headers), the spoofed display name, and the reply-to address redirecting to an attacker-controlled domain. Header analysis proves the email did not originate from the legitimate vendor’s mail servers.

2. Intellectual Property Exfiltration via Email

A departing employee forwards 2,300 emails with proprietary attachments to a personal Gmail account over 6 weeks. The OST file’s Sent Items folder contains every forwarded message with timestamps, recipient addresses, and the original attachments. The folder structure shows the employee created a “Personal Backup” folder to stage messages before forwarding.

3. PST Files on Unauthorized Media

During an insider threat investigation, a 12 GB PST file is discovered on a personal USB drive. The PST contains a complete export of the employee’s corporate mailbox, including messages from privileged distribution lists. File system timestamps show the PST was created at 22:47 on the employee’s last day, and the PST metadata reveals it was exported using Outlook’s Import/Export wizard.

4. Deleted Email Recovery

A subject deletes incriminating emails from their mailbox. The OST file’s Deleted Items folder or the recoverable items dumpster (if Exchange Online retention policies are in effect) still contains the messages. Even if the Deleted Items folder was emptied, MAPI-level recovery tools can sometimes extract deleted message fragments from PST/OST free space.

5. Phishing Campaign Analysis

After a successful phishing attack compromises multiple employees, their OST files are collected to identify the full scope of the campaign. Search across all OST files for the phishing sender address, subject line, or attachment hash reveals every recipient and whether they interacted with the message (replies, forwards).

Acquisition Methods

:: Collect OST and PST files using KAPE
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target Outlook

:: Manual collection (Outlook must be closed)
copy "C:\Users\jdoe\AppData\Local\Microsoft\Outlook\*.ost" C:\Evidence\Outlook\
copy "C:\Users\jdoe\Documents\Outlook Files\*.pst" C:\Evidence\Outlook\

:: Search for PST files anywhere on the system
dir /s /b C:\*.pst

Parsing Tools & Analysis

# Extract all messages from PST to EML format using libpff
pffexport /analysis/outlook/archive.pst

# Convert PST to mbox format using readpst
readpst -o /analysis/outlook/mbox_output/ -e /analysis/outlook/archive.pst

# Search extracted EML files for specific sender
grep -rl "attacker@evil.com" /analysis/outlook/mbox_output/

Retention & Persistence

Version Differences

Anti-Forensics Resilience

MITRE ATT&CK Detection Mapping

Related Artifacts & Cross-References

References

1. Microsoft, “MS-PST: Personal Storage File Format” — learn.microsoft.com
2. Joachim Metz, “libpff” — github.com/libyal/libpff
3. libpst project, “readpst” — five-ten-sg.com/libpst
4. SANS Institute, “Email Forensics” — sans.org
5. Microsoft, “Outlook Data Files (.pst and .ost)” — learn.microsoft.com