Tuesday, January 22, 2013

Backtrack Forensics: convert PST mail files with readpst

Menu: Forensics -> Forensic Analysis Tools
Directory: /usr/local/bin/
lspst
readpst
pst2ldif

readpst is part of the libpst package, and it can read PST (and OST) files, and convert them to mbox, Kmail, MH or simple txt format. It can handle encrypted files as well, as the PST encryption uses a known master key to encrypt the user key, thus it can be easily decrypted. lspst is a tool to list mails in a PST file, and pst2ldif is to convert the file to LDIF, these two apps are coming with the libpst package. There is one more, pst2dii, which converts files to DII format, but it's not found in BT. There is nothing more about it, so let's see how to use it.

lspst [filename] - list mails in a PST, for me it doesn't always work, and get the following error:

"A second message_store has been found. Sorry, this must be an error."


Anyway readpst will still work and extract the messages. I found it working with any version of PST (from Outlook 97 to 2013)

readpst [filename] - most simple usage, converts the PST to MBOX format, which can be read with the Linux mail command
mail -f [mbox file] - read mbox file
readpst -r [filename] - will create directory structure for the mail files
readpst -S [filename] - converts PST to speparate format, meaning it will create txt and rtf file for each individual message and save the attachments as a separate file

Rest of the options is really just other formats, or exclusion of some items from the conversion.

Simple usage, we can see that one new file created, which is the mbox file ("Personal"):


Converting to individual files, with a folder structure:


Converting to directory structure:


Navigating in the directories, and using the mail utility:


Official website: http://www.five-ten-sg.com/libpst/

6 comments:

Mithilesh Tata said...

Read this blog get better solution for OST and PST file.
http://www.linkedin.com/today/post/article/20140327103717-240215129-find-out-three-best-microsoft-outlook-ost-to-pst-conversion-way

Unknown said...

If you wants to move the significance OST file into to MBOX file format, then you can download Kernel for OST to PST tool because such not only save repair ost file in pst file it also save in MBOX and file format.

Visit here: http://www.osttohtml.osttopstfree.com/

Lara said...

Restore your corrupted, deleted and lost email files, attachments, notes etc. with help of OST converter without causing any further damages to the originals.

Unknown said...

Get a wonderful email Migrator from Digital Tweaks and run it by following easy steps as instructed. http://www.quora.com/What-is-the-correct-way-to-convert-PST-to-MBOX-for-free

Unknown said...

Thanks for sharing such informative post as we do need a good email converter software for migration of OST to PST.

Sivachandran said...

Prepared a Docker image for easy access. You can check it out here https://hub.docker.com/r/sivachandran/pst-utils.