[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESQ0TNQ8VG4BHF8HD2VCGT":3,"skill-same:01M6ESQ0TNQ8VG4BHF8HD2VCGT":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6ESQ0TNQ8VG4BHF8HD2VCGT","analyzing-outlook-pst-for-email-forensics",null,"Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"email","forensics","analyzing","pst","outlook","analyzing outlook pst for email forensics","email-headers","emails","incident","manage","files","evidence","analyze","analysis","attachments","cybersecurity","mapi","ost","email-forensics","incident response","2026-11-10 10:12:30",false,"---\nname: analyzing-outlook-pst-for-email-forensics\ndescription: Analyze Microsoft Outlook PST and OST files for email forensic evidence\n  including message content, headers, attachments, deleted items, and metadata using\n  libpff, pst-utils, and forensic email analysis tools for legal investigations and\n  incident response.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- email-forensics\n- pst\n- ost\n- outlook\n- mapi\n- email-headers\n- attachments\n- deleted-emails\n- libpff\n- eml-extraction\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MANAGE-2.4\n- MANAGE-3.1\n- MEASURE-3.1\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1114.001\n- T1564.008\n- T1070.008\n---\n\n# Analyzing Outlook PST for Email Forensics\n\n## Overview\n\nMicrosoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing outlook pst for email forensics\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- libpff\u002Fpffexport (open-source PST parser)\n- Python 3.8+ with pypff or libratom libraries\n- MailXaminer, Forensic Email Collector, or SysTools PST Forensics (commercial)\n- Microsoft Outlook (optional, for native PST access)\n- Sufficient disk space for extracted content\n\n## PST File Locations\n\n| Source | Path |\n|--------|------|\n| Outlook 2016+ Default | %USERPROFILE%\\Documents\\Outlook Files\\*.pst |\n| Outlook Legacy | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.pst |\n| OST Cache | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.ost |\n| Archive | %USERPROFILE%\\Documents\\Outlook Files\\archive.pst |\n\n## Analysis with Open-Source Tools\n\n### libpff \u002F pffexport\n\n```bash\n# Export all items from PST file\npffexport -m all evidence.pst -t exported_pst\n\n# Export only email messages\npffexport -m items evidence.pst -t exported_emails\n\n# Export recovered\u002Fdeleted items\npffexport -m recovered evidence.pst -t recovered_items\n\n# Get PST file information\npffinfo evidence.pst\n```\n\n### Python PST Analysis\n\n```python\nimport pypff\nimport os\nimport json\nimport hashlib\nimport email\nimport sys\nfrom datetime import datetime\nfrom collections import defaultdict\n\n\nclass PSTForensicAnalyzer:\n    \"\"\"Forensic analysis of Outlook PST\u002FOST files.\"\"\"\n\n    def __init__(self, pst_path: str, output_dir: str):\n        self.pst_path = pst_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.pst = pypff.file()\n        self.pst.open(pst_path)\n        self.messages = []\n        self.attachments = []\n        self.stats = defaultdict(int)\n\n    def process_folder(self, folder, folder_path: str = \"\"):\n        \"\"\"Recursively process PST folders and extract messages.\"\"\"\n        folder_name = folder.name or \"Root\"\n        current_path = f\"{folder_path}\u002F{folder_name}\" if folder_path else folder_name\n\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                msg_data = self.extract_message(message, current_path)\n                if msg_data:\n                    self.messages.append(msg_data)\n                    self.stats[\"total_messages\"] += 1\n            except Exception as e:\n                self.stats[\"parse_errors\"] += 1\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                subfolder = folder.get_sub_folder(i)\n                self.process_folder(subfolder, current_path)\n            except Exception:\n                continue\n\n    def extract_message(self, message, folder_path: str) -> dict:\n        \"\"\"Extract forensic metadata from a single email message.\"\"\"\n        msg_data = {\n            \"folder\": folder_path,\n            \"subject\": message.subject or \"\",\n            \"sender\": message.sender_name or \"\",\n            \"sender_email\": \"\",\n            \"creation_time\": str(message.creation_time) if message.creation_time else None,\n            \"delivery_time\": str(message.delivery_time) if message.delivery_time else None,\n            \"modification_time\": str(message.modification_time) if message.modification_time else None,\n            \"has_attachments\": message.number_of_attachments > 0,\n            \"attachment_count\": message.number_of_attachments,\n            \"body_size\": len(message.plain_text_body or b\"\"),\n            \"html_size\": len(message.html_body or b\"\"),\n        }\n\n        # Extract transport headers for routing analysis\n        headers = message.transport_headers\n        if headers:\n            msg_data[\"headers_present\"] = True\n            msg_data[\"headers_size\"] = len(headers)\n            # Parse key headers\n            parsed = email.message_from_string(headers)\n            msg_data[\"from_header\"] = parsed.get(\"From\", \"\")\n            msg_data[\"to_header\"] = parsed.get(\"To\", \"\")\n            msg_data[\"date_header\"] = parsed.get(\"Date\", \"\")\n            msg_data[\"message_id\"] = parsed.get(\"Message-ID\", \"\")\n            msg_data[\"x_originating_ip\"] = parsed.get(\"X-Originating-IP\", \"\")\n            msg_data[\"received_headers\"] = parsed.get_all(\"Received\", [])\n\n        # Process attachments\n        for j in range(message.number_of_attachments):\n            try:\n                attachment = message.get_attachment(j)\n                att_data = {\n                    \"message_subject\": msg_data[\"subject\"],\n                    \"name\": attachment.name or f\"attachment_{j}\",\n                    \"size\": attachment.size,\n                    \"content_type\": \"\",\n                }\n                self.attachments.append(att_data)\n                self.stats[\"total_attachments\"] += 1\n            except Exception:\n                continue\n\n        return msg_data\n\n    def save_attachments(self, max_size_mb: int = 100):\n        \"\"\"Export attachments to disk for analysis.\"\"\"\n        att_dir = os.path.join(self.output_dir, \"attachments\")\n        os.makedirs(att_dir, exist_ok=True)\n\n        root = self.pst.get_root_folder()\n        self._save_attachments_recursive(root, att_dir, max_size_mb)\n\n    def _save_attachments_recursive(self, folder, att_dir, max_size_mb):\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                for j in range(message.number_of_attachments):\n                    att = message.get_attachment(j)\n                    if att.size and att.size \u003C max_size_mb * 1024 * 1024:\n                        name = att.name or f\"unknown_{i}_{j}\"\n                        safe_name = \"\".join(c if c.isalnum() or c in \".-_\" else \"_\" for c in name)\n                        path = os.path.join(att_dir, safe_name)\n                        try:\n                            data = att.read_buffer(att.size)\n                            with open(path, \"wb\") as f:\n                                f.write(data)\n                        except Exception:\n                            continue\n            except Exception:\n                continue\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                self._save_attachments_recursive(folder.get_sub_folder(i), att_dir, max_size_mb)\n            except Exception:\n                continue\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PST forensic analysis report.\"\"\"\n        root = self.pst.get_root_folder()\n        self.process_folder(root)\n\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pst_file\": self.pst_path,\n            \"pst_size_bytes\": os.path.getsize(self.pst_path),\n            \"statistics\": dict(self.stats),\n            \"messages\": self.messages[:500],\n            \"attachments\": self.attachments[:200],\n        }\n\n        report_path = os.path.join(self.output_dir, \"pst_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2, default=str)\n\n        print(f\"[*] Total messages: {self.stats['total_messages']}\")\n        print(f\"[*] Total attachments: {self.stats['total_attachments']}\")\n        print(f\"[*] Parse errors: {self.stats['parse_errors']}\")\n        return report_path\n\n    def close(self):\n        self.pst.close()\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpst_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PSTForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n    analyzer.close()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Email Header Analysis\n\nKey headers for forensic investigation:\n\n| Header | Forensic Value |\n|--------|---------------|\n| Received | Message routing chain (read bottom to top) |\n| X-Originating-IP | Sender's actual IP address |\n| Message-ID | Unique identifier for correlation |\n| Date | Send timestamp |\n| Return-Path | Bounce address (may differ from From) |\n| DKIM-Signature | Domain authentication signature |\n| Authentication-Results | SPF, DKIM, DMARC verification results |\n| X-Mailer | Email client used |\n\n## References\n\n- MailXaminer PST Forensics: https:\u002F\u002Fwww.mailxaminer.com\u002Fblog\u002Foutlook-pst-file-forensics\u002F\n- libpff Documentation: https:\u002F\u002Fgithub.com\u002Flibyal\u002Flibpff\n- PST File Format Specification: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Foffice_file_formats\u002Fms-pst\u002F\n- SANS Email Forensics: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Femail-forensics\u002F\n\n## Example Output\n\n```text\n$ pffexport \u002Fevidence\u002Fjsmith_archive.pst -t \u002Fanalysis\u002Fpst_output\n\npffexport 20231205 - libpff PST\u002FOST Export Tool\n=================================================\nInput: \u002Fevidence\u002Fjsmith_archive.pst (2.3 GB)\n\nExporting PST contents...\n  Folders:       45\n  Messages:      12,456\n  Attachments:   3,234\n  Contacts:      567\n  Calendar:      234\n  Tasks:         89\n\nExport completed in 3m 42s.\n\n$ python3 pst_analyzer.py \u002Fanalysis\u002Fpst_output \u002Fanalysis\u002Femail_report\n\nPST Forensic Analysis Report\n==============================\nSource: jsmith_archive.pst (john.smith@corporate.com)\nDate Range: 2023-06-01 to 2024-01-18\n\n--- Mailbox Statistics ---\n  Total Emails:       12,456\n  Sent:               4,567\n  Received:           7,889\n  With Attachments:   3,234\n  Deleted (recovered): 234\n\n--- Phishing \u002F Suspicious Emails ---\nEmail #8923\n  Date:        2024-01-15 14:30:22 UTC\n  From:        \"IT Support\" \u003Cit-support@c0rporate-help.com>\n  To:          john.smith@corporate.com\n  Subject:     Urgent: Password Reset Required\n  Headers:\n    Return-Path:    bounce@mail-relay.c0rporate-help.com\n    X-Originating-IP: 203.0.113.55\n    Received:       from mail-relay.c0rporate-help.com (203.0.113.55)\n    SPF:            FAIL (domain c0rporate-help.com)\n    DKIM:           NONE\n    DMARC:          FAIL\n  Attachments:\n    - Password_Reset_Form.xlsm (245 KB) SHA-256: 7a3b8c9d...e1f2a3b4\n  Body Preview:  \"Dear Employee, Your password will expire in 24 hours.\n                  Please open the attached form to reset your credentials...\"\n\n--- Data Exfiltration Indicators ---\nEmail #9102\n  Date:        2024-01-16 03:15:45 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     (no subject)\n  Attachments:\n    - archive_part1.7z (24.5 MB) - encrypted\n    - archive_part2.7z (24.5 MB) - encrypted\n\nEmail #9103\n  Date:        2024-01-16 03:18:22 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     Re:\n  Attachments:\n    - archive_part3.7z (18.2 MB) - encrypted\n\n--- Keyword Hits ---\n  \"confidential\":     45 emails\n  \"password\":         23 emails\n  \"transfer\":         12 emails\n  \"resign\":           3 emails\n  \"delete evidence\":  1 email (Email #9200, 2024-01-17 22:30:00 UTC)\n\nSummary:\n  Phishing emails detected:    1 (initial compromise vector)\n  Suspicious sent emails:      5 (to personal accounts with attachments)\n  Encrypted attachments:       3 (67.2 MB total - possible exfiltration)\n  Report: \u002Fanalysis\u002Femail_report\u002Fpst_forensic_report.json\n```\n","# Analyzing Outlook PST for Email Forensics\n\n## Overview\n\nMicrosoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing outlook pst for email forensics\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- libpff\u002Fpffexport (open-source PST parser)\n- Python 3.8+ with pypff or libratom libraries\n- MailXaminer, Forensic Email Collector, or SysTools PST Forensics (commercial)\n- Microsoft Outlook (optional, for native PST access)\n- Sufficient disk space for extracted content\n\n## PST File Locations\n\n| Source | Path |\n|--------|------|\n| Outlook 2016+ Default | %USERPROFILE%\\Documents\\Outlook Files\\*.pst |\n| Outlook Legacy | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.pst |\n| OST Cache | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.ost |\n| Archive | %USERPROFILE%\\Documents\\Outlook Files\\archive.pst |\n\n## Analysis with Open-Source Tools\n\n### libpff \u002F pffexport\n\n```bash\n# Export all items from PST file\npffexport -m all evidence.pst -t exported_pst\n\n# Export only email messages\npffexport -m items evidence.pst -t exported_emails\n\n# Export recovered\u002Fdeleted items\npffexport -m recovered evidence.pst -t recovered_items\n\n# Get PST file information\npffinfo evidence.pst\n```\n\n### Python PST Analysis\n\n```python\nimport pypff\nimport os\nimport json\nimport hashlib\nimport email\nimport sys\nfrom datetime import datetime\nfrom collections import defaultdict\n\n\nclass PSTForensicAnalyzer:\n    \"\"\"Forensic analysis of Outlook PST\u002FOST files.\"\"\"\n\n    def __init__(self, pst_path: str, output_dir: str):\n        self.pst_path = pst_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.pst = pypff.file()\n        self.pst.open(pst_path)\n        self.messages = []\n        self.attachments = []\n        self.stats = defaultdict(int)\n\n    def process_folder(self, folder, folder_path: str = \"\"):\n        \"\"\"Recursively process PST folders and extract messages.\"\"\"\n        folder_name = folder.name or \"Root\"\n        current_path = f\"{folder_path}\u002F{folder_name}\" if folder_path else folder_name\n\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                msg_data = self.extract_message(message, current_path)\n                if msg_data:\n                    self.messages.append(msg_data)\n                    self.stats[\"total_messages\"] += 1\n            except Exception as e:\n                self.stats[\"parse_errors\"] += 1\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                subfolder = folder.get_sub_folder(i)\n                self.process_folder(subfolder, current_path)\n            except Exception:\n                continue\n\n    def extract_message(self, message, folder_path: str) -> dict:\n        \"\"\"Extract forensic metadata from a single email message.\"\"\"\n        msg_data = {\n            \"folder\": folder_path,\n            \"subject\": message.subject or \"\",\n            \"sender\": message.sender_name or \"\",\n            \"sender_email\": \"\",\n            \"creation_time\": str(message.creation_time) if message.creation_time else None,\n            \"delivery_time\": str(message.delivery_time) if message.delivery_time else None,\n            \"modification_time\": str(message.modification_time) if message.modification_time else None,\n            \"has_attachments\": message.number_of_attachments > 0,\n            \"attachment_count\": message.number_of_attachments,\n            \"body_size\": len(message.plain_text_body or b\"\"),\n            \"html_size\": len(message.html_body or b\"\"),\n        }\n\n        # Extract transport headers for routing analysis\n        headers = message.transport_headers\n        if headers:\n            msg_data[\"headers_present\"] = True\n            msg_data[\"headers_size\"] = len(headers)\n            # Parse key headers\n            parsed = email.message_from_string(headers)\n            msg_data[\"from_header\"] = parsed.get(\"From\", \"\")\n            msg_data[\"to_header\"] = parsed.get(\"To\", \"\")\n            msg_data[\"date_header\"] = parsed.get(\"Date\", \"\")\n            msg_data[\"message_id\"] = parsed.get(\"Message-ID\", \"\")\n            msg_data[\"x_originating_ip\"] = parsed.get(\"X-Originating-IP\", \"\")\n            msg_data[\"received_headers\"] = parsed.get_all(\"Received\", [])\n\n        # Process attachments\n        for j in range(message.number_of_attachments):\n            try:\n                attachment = message.get_attachment(j)\n                att_data = {\n                    \"message_subject\": msg_data[\"subject\"],\n                    \"name\": attachment.name or f\"attachment_{j}\",\n                    \"size\": attachment.size,\n                    \"content_type\": \"\",\n                }\n                self.attachments.append(att_data)\n                self.stats[\"total_attachments\"] += 1\n            except Exception:\n                continue\n\n        return msg_data\n\n    def save_attachments(self, max_size_mb: int = 100):\n        \"\"\"Export attachments to disk for analysis.\"\"\"\n        att_dir = os.path.join(self.output_dir, \"attachments\")\n        os.makedirs(att_dir, exist_ok=True)\n\n        root = self.pst.get_root_folder()\n        self._save_attachments_recursive(root, att_dir, max_size_mb)\n\n    def _save_attachments_recursive(self, folder, att_dir, max_size_mb):\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                for j in range(message.number_of_attachments):\n                    att = message.get_attachment(j)\n                    if att.size and att.size \u003C max_size_mb * 1024 * 1024:\n                        name = att.name or f\"unknown_{i}_{j}\"\n                        safe_name = \"\".join(c if c.isalnum() or c in \".-_\" else \"_\" for c in name)\n                        path = os.path.join(att_dir, safe_name)\n                        try:\n                            data = att.read_buffer(att.size)\n                            with open(path, \"wb\") as f:\n                                f.write(data)\n                        except Exception:\n                            continue\n            except Exception:\n                continue\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                self._save_attachments_recursive(folder.get_sub_folder(i), att_dir, max_size_mb)\n            except Exception:\n                continue\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PST forensic analysis report.\"\"\"\n        root = self.pst.get_root_folder()\n        self.process_folder(root)\n\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pst_file\": self.pst_path,\n            \"pst_size_bytes\": os.path.getsize(self.pst_path),\n            \"statistics\": dict(self.stats),\n            \"messages\": self.messages[:500],\n            \"attachments\": self.attachments[:200],\n        }\n\n        report_path = os.path.join(self.output_dir, \"pst_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2, default=str)\n\n        print(f\"[*] Total messages: {self.stats['total_messages']}\")\n        print(f\"[*] Total attachments: {self.stats['total_attachments']}\")\n        print(f\"[*] Parse errors: {self.stats['parse_errors']}\")\n        return report_path\n\n    def close(self):\n        self.pst.close()\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpst_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PSTForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n    analyzer.close()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Email Header Analysis\n\nKey headers for forensic investigation:\n\n| Header | Forensic Value |\n|--------|---------------|\n| Received | Message routing chain (read bottom to top) |\n| X-Originating-IP | Sender's actual IP address |\n| Message-ID | Unique identifier for correlation |\n| Date | Send timestamp |\n| Return-Path | Bounce address (may differ from From) |\n| DKIM-Signature | Domain authentication signature |\n| Authentication-Results | SPF, DKIM, DMARC verification results |\n| X-Mailer | Email client used |\n\n## References\n\n- MailXaminer PST Forensics: https:\u002F\u002Fwww.mailxaminer.com\u002Fblog\u002Foutlook-pst-file-forensics\u002F\n- libpff Documentation: https:\u002F\u002Fgithub.com\u002Flibyal\u002Flibpff\n- PST File Format Specification: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Foffice_file_formats\u002Fms-pst\u002F\n- SANS Email Forensics: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Femail-forensics\u002F\n\n## Example Output\n\n```text\n$ pffexport \u002Fevidence\u002Fjsmith_archive.pst -t \u002Fanalysis\u002Fpst_output\n\npffexport 20231205 - libpff PST\u002FOST Export Tool\n=================================================\nInput: \u002Fevidence\u002Fjsmith_archive.pst (2.3 GB)\n\nExporting PST contents...\n  Folders:       45\n  Messages:      12,456\n  Attachments:   3,234\n  Contacts:      567\n  Calendar:      234\n  Tasks:         89\n\nExport completed in 3m 42s.\n\n$ python3 pst_analyzer.py \u002Fanalysis\u002Fpst_output \u002Fanalysis\u002Femail_report\n\nPST Forensic Analysis Report\n==============================\nSource: jsmith_archive.pst (john.smith@corporate.com)\nDate Range: 2023-06-01 to 2024-01-18\n\n--- Mailbox Statistics ---\n  Total Emails:       12,456\n  Sent:               4,567\n  Received:           7,889\n  With Attachments:   3,234\n  Deleted (recovered): 234\n\n--- Phishing \u002F Suspicious Emails ---\nEmail #8923\n  Date:        2024-01-15 14:30:22 UTC\n  From:        \"IT Support\" \u003Cit-support@c0rporate-help.com>\n  To:          john.smith@corporate.com\n  Subject:     Urgent: Password Reset Required\n  Headers:\n    Return-Path:    bounce@mail-relay.c0rporate-help.com\n    X-Originating-IP: 203.0.113.55\n    Received:       from mail-relay.c0rporate-help.com (203.0.113.55)\n    SPF:            FAIL (domain c0rporate-help.com)\n    DKIM:           NONE\n    DMARC:          FAIL\n  Attachments:\n    - Password_Reset_Form.xlsm (245 KB) SHA-256: 7a3b8c9d...e1f2a3b4\n  Body Preview:  \"Dear Employee, Your password will expire in 24 hours.\n                  Please open the attached form to reset your credentials...\"\n\n--- Data Exfiltration Indicators ---\nEmail #9102\n  Date:        2024-01-16 03:15:45 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     (no subject)\n  Attachments:\n    - archive_part1.7z (24.5 MB) - encrypted\n    - archive_part2.7z (24.5 MB) - encrypted\n\nEmail #9103\n  Date:        2024-01-16 03:18:22 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     Re:\n  Attachments:\n    - archive_part3.7z (18.2 MB) - encrypted\n\n--- Keyword Hits ---\n  \"confidential\":     45 emails\n  \"password\":         23 emails\n  \"transfer\":         12 emails\n  \"resign\":           3 emails\n  \"delete evidence\":  1 email (Email #9200, 2024-01-17 22:30:00 UTC)\n\nSummary:\n  Phishing emails detected:    1 (initial compromise vector)\n  Suspicious sent emails:      5 (to personal accounts with attachments)\n  Encrypted attachments:       3 (67.2 MB total - possible exfiltration)\n  Report: \u002Fanalysis\u002Femail_report\u002Fpst_forensic_report.json\n```\n",{"name":5,"tags":49,"author":53,"domain":39,"license":15,"version":54,"nist_csf":55,"subdomain":60,"description":7,"nist_ai_rmf":61,"mitre_attack":65},[42,27,41,28,40,30,38,50,51,52],"deleted-emails","libpff","eml-extraction","mahipal","1.0",[56,57,58,59],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[62,63,64],"MANAGE-2.4","MANAGE-3.1","MEASURE-3.1",[66,67,68],"T1114.001","T1564.008","T1070.008","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-outlook-pst-for-email-forensics",{"tool":83,"command":84},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-outlook-pst-for-email-forensics",{"tool":86,"command":87},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-outlook-pst-for-email-forensics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002FSKILL.md",true,[91,96,102,106,110],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2566,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",634,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",397,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",5996,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-outlook-pst-for-email-forensics\u002Fscripts\u002Fagent.py",[117,157,166,175,197,224],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":138,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[124,127,130,133],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,34,155,156],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","youtube","with",{"skillNo":158,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[161,162,163,164],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,34,155,156],{"skillNo":167,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[170,171,172,173],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,34,155,156],{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,191,192,193,194,195,196],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":206,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[203],{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[207,208,209,210,211,212,37,213,214,215,216,150,151,217,218,219,220,221,222,223],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":240,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[230,233,236,237],{"categoryNo":231,"categoryName":232,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":234,"categoryName":235,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":238,"categoryName":239,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000036","内容创作者",[241,242,243,244,245,246,247,248,147,249,150,151,152,250,251,252,253,254,196,255],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]