Backtrack Forensics: convert PST mail files with readpst

Menu: Forensics -> Forensic Analysis Tools
Directory: /usr/local/bin/
lspst
readpst
pst2ldif

readpst is part of the libpst package, and it can read PST (and OST) files, and convert them to mbox, Kmail, MH or simple txt format. It can handle encrypted files as well, as the PST encryption uses a known master key to encrypt the user key, thus it can be easily decrypted. lspst is a tool to list mails in a PST file, and pst2ldif is to convert the file to LDIF, these two apps are coming with the libpst package. There is one more, pst2dii, which converts files to DII format, but it's not found in BT. There is nothing more about it, so let's see how to use it.

lspst [filename] - list mails in a PST, for me it doesn't always work, and get the following error:

"A second message_store has been found. Sorry, this must be an error."

Anyway readpst will still work and extract the messages. I found it working with any version of PST (from Outlook 97 to 2013)

readpst [filename] - most simple usage, converts the PST to MBOX format, which can be read with the Linux mail command

mail -f [mbox file] - read mbox file

readpst -r [filename] - will create directory structure for the mail files

readpst -S [filename] - converts PST to speparate format, meaning it will create txt and rtf file for each individual message and save the attachments as a separate file

Rest of the options is really just other formats, or exclusion of some items from the conversion.

Simple usage, we can see that one new file created, which is the mbox file ("Personal"):

Converting to individual files, with a folder structure:

Converting to directory structure:

Navigating in the directories, and using the mail utility:

Official website: http://www.five-ten-sg.com/libpst/