{"id":184,"date":"2023-12-21T15:16:56","date_gmt":"2023-12-21T09:46:56","guid":{"rendered":"https:\/\/www.forensicsware.com\/blog\/?p=184"},"modified":"2023-12-21T16:53:16","modified_gmt":"2023-12-21T11:23:16","slug":"pst-file-forensics-investigation","status":"publish","type":"post","link":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/","title":{"rendered":"PST File Forensics Investigation to Examine Outlook Data File"},"content":{"rendered":"

Forensics professionals handle different file types such as OST, PST, EML, MBOX, MSG, etc to investigate a case. Particularly when it comes to PST file forensics, the focus is on investigating all the data including emails, contacts, calendar items, and other mailbox data. Let\u2019s understand more about the PST file and its core investigation aspects.<\/span><\/p>\n

What Information do PST Files Contain?<\/strong><\/h2>\n

PST is one of the default file formats of Microsoft Outlook. It is used for business-level communication information related to calendar events, contacts, tasks, journals, notes, etc. Analyzing these files accurately requires a special set of skills and tools.<\/span><\/p>\n

Before analyzing, you need to first understand the PST file structure which consists of folders, sub-folders, and other items.<\/span><\/p>\n

Anyway, when you want to perform PST file forensics without Outlook, the best option would be to opt for professional forensics software. The link to the forensics tool is given below.<\/span><\/p>\n

Schedule a Demo<\/a> Purchase Tool<\/a><\/p>\n

Now, let\u2019s move forward and see what data in the PST file you can analyze with the help of the tool.<\/span><\/p>\n

PST File Forensics – Decode the Layers of Data within PST<\/strong><\/h2>\n

The proficient investigation tool can help search for relevant information from the PST file that is linked to the case. Here are some of the core information that you\u2019ll get to examine.<\/span><\/p>\n

1. Internal Information<\/b><\/p>\n

Every piece of information counts when doing PST file forensics. As an investigator, you can analyze; email data which includes sender & recipient, subject, Date and time, and Message body. You can also analyze contact names, email addresses, phone numbers, and organizational information. It doesn\u2019t stop here. While investigating PST files, you can find event details such as event time, location of the event, who the attendees were, etc.<\/span><\/p>\n

2. Metadata<\/b><\/p>\n

With the PST file forensics tool, you can examine the data associated with each item creation and modification of timestamps, etc. This can ultimately help reconstruct the timeline of events.\u00a0<\/span><\/p>\n

3. Header Information<\/b><\/p>\n

While investigating the header of the PST file using the tool, you can find the information about format version, encryption status, and other attributes.<\/span><\/p>\n

4. Deleted Items<\/b><\/p>\n

Sometimes deleted items contain more valuable information that could benefit the whole case. With the help of this tool, you\u2019ll be able to recover the deleted items and analyze them.<\/span><\/p>\n

5. Attachments<\/b><\/p>\n

You may encounter emails with attachments while performing PST file forensics. These attachments could be the source of valuable information that could help you trace the footprints.<\/span><\/p>\n

6. Search & Filtering<\/b><\/p>\n

In case the investigation demands a search of keywords, timestamps, and results of search queries, then you can rely on the tool. It will provide you the option to customize the search and filter according to your needs.<\/span><\/p>\n

7. Link Analysis<\/b><\/p>\n

This plays a crucial role in PST file forensics. It helps investigators find out the relationships, connections, and patterns between various elements within the mailbox data. Evidently, the tool has the exact features that could match your expectations.<\/span><\/p>\n

Here\u2019s the screenshot of the tool in case you wondering what\u2019s the tool looks like.<\/span><\/p>\n

\"PST<\/p>\n

Conclusion<\/b><\/h3>\n

PST file forensics is a detailed process that requires attention to detail from start to end. Some suggest using <\/span>PST viewer <\/b><\/a>for analyzing the data inside it. Though it will help you view the content in the PST file, you\u2019ll need a tool (like the above-mentioned one) that\u2019s specially engineered for forensics purposes for doing in-depth analysis.\u00a0<\/span><\/p>\n

FAQs<\/b><\/h3>\n

Q- Why is PST file forensics important?<\/b><\/p>\n

It is important because it allows experts to examine email communication, rebuild timelines, recover deleted items, and extract valuable evidence that can contribute to the overall understanding of a case.<\/span><\/p>\n

Q- What challenges do forensics analysts face while investigating PST files?<\/b><\/p>\n

Some of the challenges of PST file forensics include forensics examiners receiving encrypted PST files. Or, in some cases, they are assigned corrupt PST files for doing the analysis.<\/span><\/p>\n

Q- What kind of information can be found in a PST file during the investigation?<\/b><\/p>\n

A PST file for the investigation may contain emails, contacts, calendar events, attachments, links, or other digital activities.<\/span><\/p>\n

Q- Can forensics analysis of PST files help in tracing email sources?<\/b><\/p>\n

Yes, particularly the <\/span>forensics of email header<\/span><\/a> helps in tracing the source of the email. With the help of an IP address experts can track the geographical location.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Forensics professionals handle different file types such as OST, PST, EML, MBOX, MSG, etc to investigate a case. Particularly when it comes to PST file forensics, the focus is <\/p>\n","protected":false},"author":2,"featured_media":185,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"yoast_head":"\nHow to Do PST File Forensics? Complete Investigation Process<\/title>\n<meta name=\"description\" content=\"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Do PST File Forensics? Complete Investigation Process\" \/>\n<meta property=\"og:description\" content=\"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital Forensic Services \u2014 Computer Forensics Investigators & eDiscovery Experts\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-21T09:46:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-21T11:23:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png\" \/>\n\t<meta property=\"og:image:width\" content=\"700\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sambita\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sambita\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/\"},\"author\":{\"name\":\"Sambita\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/#\\\/schema\\\/person\\\/753fb9b344047ddc50397a4c975d7e54\"},\"headline\":\"PST File Forensics Investigation to Examine Outlook Data File\",\"datePublished\":\"2023-12-21T09:46:56+00:00\",\"dateModified\":\"2023-12-21T11:23:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/\"},\"wordCount\":730,\"image\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/pst-file-forensics.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/\",\"url\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/\",\"name\":\"How to Do PST File Forensics? Complete Investigation Process\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/pst-file-forensics.png\",\"datePublished\":\"2023-12-21T09:46:56+00:00\",\"dateModified\":\"2023-12-21T11:23:16+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/#\\\/schema\\\/person\\\/753fb9b344047ddc50397a4c975d7e54\"},\"description\":\"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/pst-file-forensics.png\",\"contentUrl\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/pst-file-forensics.png\",\"width\":700,\"height\":400,\"caption\":\"pst file forensics\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/pst-file-forensics-investigation\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PST File Forensics Investigation to Examine Outlook Data File\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/\",\"name\":\"Digital Forensic Services \u2014 Computer Forensics Investigators & eDiscovery Experts\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/#\\\/schema\\\/person\\\/753fb9b344047ddc50397a4c975d7e54\",\"name\":\"Sambita\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g\",\"caption\":\"Sambita\"},\"description\":\"Sambita is a researcher and writer having a keen interest in cybersecurity, digital forensics, and modern technology. With a deep understanding and a desire to indulge in the field of cyber security, she keeps herself up-to-date with the emerging cybersecurity developments and likes to share her knowledge to help businesses & individuals understand the constantly evolving world of online security.\",\"sameAs\":[\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/wp-content\\\/themes\\\/fw\\\/assets\\\/img\\\/sambita.png\"],\"url\":\"https:\\\/\\\/www.forensicsware.com\\\/blog\\\/author\\\/sambita\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Do PST File Forensics? Complete Investigation Process","description":"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/","og_locale":"en_US","og_type":"article","og_title":"How to Do PST File Forensics? Complete Investigation Process","og_description":"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.","og_url":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/","og_site_name":"Digital Forensic Services \u2014 Computer Forensics Investigators & eDiscovery Experts","article_published_time":"2023-12-21T09:46:56+00:00","article_modified_time":"2023-12-21T11:23:16+00:00","og_image":[{"width":700,"height":400,"url":"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png","type":"image\/png"}],"author":"Sambita","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sambita","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#article","isPartOf":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/"},"author":{"name":"Sambita","@id":"https:\/\/www.forensicsware.com\/blog\/#\/schema\/person\/753fb9b344047ddc50397a4c975d7e54"},"headline":"PST File Forensics Investigation to Examine Outlook Data File","datePublished":"2023-12-21T09:46:56+00:00","dateModified":"2023-12-21T11:23:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/"},"wordCount":730,"image":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/","url":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/","name":"How to Do PST File Forensics? Complete Investigation Process","isPartOf":{"@id":"https:\/\/www.forensicsware.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#primaryimage"},"image":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png","datePublished":"2023-12-21T09:46:56+00:00","dateModified":"2023-12-21T11:23:16+00:00","author":{"@id":"https:\/\/www.forensicsware.com\/blog\/#\/schema\/person\/753fb9b344047ddc50397a4c975d7e54"},"description":"PST file forensics includes analyzing all the components such as emails, contacts, calendars, etc present in the Outlook PST file.","breadcrumb":{"@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#primaryimage","url":"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png","contentUrl":"https:\/\/www.forensicsware.com\/blog\/wp-content\/uploads\/2023\/12\/pst-file-forensics.png","width":700,"height":400,"caption":"pst file forensics"},{"@type":"BreadcrumbList","@id":"https:\/\/www.forensicsware.com\/blog\/pst-file-forensics-investigation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.forensicsware.com\/blog\/"},{"@type":"ListItem","position":2,"name":"PST File Forensics Investigation to Examine Outlook Data File"}]},{"@type":"WebSite","@id":"https:\/\/www.forensicsware.com\/blog\/#website","url":"https:\/\/www.forensicsware.com\/blog\/","name":"Digital Forensic Services \u2014 Computer Forensics Investigators & eDiscovery Experts","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.forensicsware.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.forensicsware.com\/blog\/#\/schema\/person\/753fb9b344047ddc50397a4c975d7e54","name":"Sambita","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7c93b1a3eafc766fce03aec4a0a285a6a026caaad62d3c532c6c5b6240b2bc27?s=96&d=mm&r=g","caption":"Sambita"},"description":"Sambita is a researcher and writer having a keen interest in cybersecurity, digital forensics, and modern technology. With a deep understanding and a desire to indulge in the field of cyber security, she keeps herself up-to-date with the emerging cybersecurity developments and likes to share her knowledge to help businesses & individuals understand the constantly evolving world of online security.","sameAs":["https:\/\/www.forensicsware.com\/blog\/wp-content\/themes\/fw\/assets\/img\/sambita.png"],"url":"https:\/\/www.forensicsware.com\/blog\/author\/sambita\/"}]}},"_links":{"self":[{"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/posts\/184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/comments?post=184"}],"version-history":[{"count":4,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/posts\/184\/revisions"}],"predecessor-version":[{"id":189,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/posts\/184\/revisions\/189"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/media\/185"}],"wp:attachment":[{"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/media?parent=184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/categories?post=184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.forensicsware.com\/blog\/wp-json\/wp\/v2\/tags?post=184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}