OST & PST Forensics

OST & PST Forensics brings to the table a mailbox analysis tool for offline or personal storage files. Targeting both OST and PST files, the application can help you explore, analyze, recover, and export data stored in MS Exchange and MS Outlook files.

In an attempt to keep things as simple as possible, the main window of OST & PST Forensics displays a list of all the performed actions. The log can comprise details about opened and analyzed items, the file type, the encryption mode, the number of items and the data blocks in the opened PST or OST files. You can open this file using Notepad and save it on your computer for future reference.

To proceed to analyzing a file, you just have to press the 'Open' button. OST & PST Forensics searches for data blocks on your computer and glues them up to re-build messages, contact lists, mailbox folders, notes and attached files, then opens a new window to show you all the data in a convenient manner, in tree-view.

The root folder contains links to all the other sub-directories, including personal folders in your mailbox. For each node you select, OST & PST Forensics displays the actual message and its type, along with all its attributes. You can browse various parameters, such as recipients, the message class, importance and priority, sensitivity, message flags, sending time, and many more.

The application enables you to explore the properties of the root folder and save any field or collection of fields as a CSV or an XML file, or copy individual values to the clipboard.

If the mailbox contains a large amount of data, exploring it might be tedious. That is why OST & PST Forensics also comes with an integrated search function to look up an entry by the node ID or the block ID. Moreover, you can search for a specific string or binary data.

OST & PST Forensics provides a convenient means to analyze data in offline or personal storage files, gathering all the required data blocks to help you retrieve information in the mailbox. It has all the data shown alongside the nodes IDs, which makes it a good forensics tool, ready to help you not only recover data, but also generate reports.