[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DARHBPJ47MPBPSS2MX3JF":3,"skill-same:01M71DARHBPJ47MPBPSS2MX3JF":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":14,"repositoryHtmlUrl":77,"repositoryHomepageUrl":6,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M71DARHBPJ47MPBPSS2MX3JF","forensics-outlook-forensic",null,"Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fforensics\u002Foutlook\u002Fforensic\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"outlook","forensics","forensics outlook forensic","evidence","sonnet","investigations","Tools","digital-forensics","headers","read","de","message","analyze","analysis","Bash","incident response","cybersecurity","utils","files","incident","2026-11-10 10:12:30",false,"---\nname: forensics-outlook-forensic\ndescription: Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- email-forensics\n- pst\n- ost\n- outlook\n- mapi\n- email-headers\n- attachments\n- deleted-emails\n- libpff\n- eml-extraction\nnist_ai_rmf:\n- MANAGE-2.4\n- MANAGE-3.1\n- MEASURE-3.1\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Analyzing Outlook PST for Email Forensics\n\n## Overview\n\nMicrosoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing outlook pst for email forensics\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- libpff\u002Fpffexport (open-source PST parser)\n- Python 3.8+ with pypff or libratom libraries\n- MailXaminer, Forensic Email Collector, or SysTools PST Forensics (commercial)\n- Microsoft Outlook (optional, for native PST access)\n- Sufficient disk space for extracted content\n\n## PST File Locations\n\n| Source | Path |\n|--------|------|\n| Outlook 2016+ Default | %USERPROFILE%\\Documents\\Outlook Files\\*.pst |\n| Outlook Legacy | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.pst |\n| OST Cache | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.ost |\n| Archive | %USERPROFILE%\\Documents\\Outlook Files\\archive.pst |\n\n## Analysis with Open-Source Tools\n\n### libpff \u002F pffexport\n\n```bash\n# Export all items from PST file\npffexport -m all evidence.pst -t exported_pst\n\n# Export only email messages\npffexport -m items evidence.pst -t exported_emails\n\n# Export recovered\u002Fdeleted items\npffexport -m recovered evidence.pst -t recovered_items\n\n# Get PST file information\npffinfo evidence.pst\n```\n\n### Python PST Analysis\n\n```python\nimport pypff\nimport os\nimport json\nimport hashlib\nimport email\nimport sys\nfrom datetime import datetime\nfrom collections import defaultdict\n\n\nclass PSTForensicAnalyzer:\n    \"\"\"Forensic analysis of Outlook PST\u002FOST files.\"\"\"\n\n    def __init__(self, pst_path: str, output_dir: str):\n        self.pst_path = pst_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.pst = pypff.file()\n        self.pst.open(pst_path)\n        self.messages = []\n        self.attachments = []\n        self.stats = defaultdict(int)\n\n    def process_folder(self, folder, folder_path: str = \"\"):\n        \"\"\"Recursively process PST folders and extract messages.\"\"\"\n        folder_name = folder.name or \"Root\"\n        current_path = f\"{folder_path}\u002F{folder_name}\" if folder_path else folder_name\n\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                msg_data = self.extract_message(message, current_path)\n                if msg_data:\n                    self.messages.append(msg_data)\n                    self.stats[\"total_messages\"] += 1\n            except Exception as e:\n                self.stats[\"parse_errors\"] += 1\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                subfolder = folder.get_sub_folder(i)\n                self.process_folder(subfolder, current_path)\n            except Exception:\n                continue\n\n    def extract_message(self, message, folder_path: str) -> dict:\n        \"\"\"Extract forensic metadata from a single email message.\"\"\"\n        msg_data = {\n            \"folder\": folder_path,\n            \"subject\": message.subject or \"\",\n            \"sender\": message.sender_name or \"\",\n            \"sender_email\": \"\",\n            \"creation_time\": str(message.creation_time) if message.creation_time else None,\n            \"delivery_time\": str(message.delivery_time) if message.delivery_time else None,\n            \"modification_time\": str(message.modification_time) if message.modification_time else None,\n            \"has_attachments\": message.number_of_attachments > 0,\n            \"attachment_count\": message.number_of_attachments,\n            \"body_size\": len(message.plain_text_body or b\"\"),\n            \"html_size\": len(message.html_body or b\"\"),\n        }\n\n        # Extract transport headers for routing analysis\n        headers = message.transport_headers\n        if headers:\n            msg_data[\"headers_present\"] = True\n            msg_data[\"headers_size\"] = len(headers)\n            # Parse key headers\n            parsed = email.message_from_string(headers)\n            msg_data[\"from_header\"] = parsed.get(\"From\", \"\")\n            msg_data[\"to_header\"] = parsed.get(\"To\", \"\")\n            msg_data[\"date_header\"] = parsed.get(\"Date\", \"\")\n            msg_data[\"message_id\"] = parsed.get(\"Message-ID\", \"\")\n            msg_data[\"x_originating_ip\"] = parsed.get(\"X-Originating-IP\", \"\")\n            msg_data[\"received_headers\"] = parsed.get_all(\"Received\", [])\n\n        # Process attachments\n        for j in range(message.number_of_attachments):\n            try:\n                attachment = message.get_attachment(j)\n                att_data = {\n                    \"message_subject\": msg_data[\"subject\"],\n                    \"name\": attachment.name or f\"attachment_{j}\",\n                    \"size\": attachment.size,\n                    \"content_type\": \"\",\n                }\n                self.attachments.append(att_data)\n                self.stats[\"total_attachments\"] += 1\n            except Exception:\n                continue\n\n        return msg_data\n\n    def save_attachments(self, max_size_mb: int = 100):\n        \"\"\"Export attachments to disk for analysis.\"\"\"\n        att_dir = os.path.join(self.output_dir, \"attachments\")\n        os.makedirs(att_dir, exist_ok=True)\n\n        root = self.pst.get_root_folder()\n        self._save_attachments_recursive(root, att_dir, max_size_mb)\n\n    def _save_attachments_recursive(self, folder, att_dir, max_size_mb):\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                for j in range(message.number_of_attachments):\n                    att = message.get_attachment(j)\n                    if att.size and att.size \u003C max_size_mb * 1024 * 1024:\n                        name = att.name or f\"unknown_{i}_{j}\"\n                        safe_name = \"\".join(c if c.isalnum() or c in \".-_\" else \"_\" for c in name)\n                        path = os.path.join(att_dir, safe_name)\n                        try:\n                            data = att.read_buffer(att.size)\n                            with open(path, \"wb\") as f:\n                                f.write(data)\n                        except Exception:\n                            continue\n            except Exception:\n                continue\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                self._save_attachments_recursive(folder.get_sub_folder(i), att_dir, max_size_mb)\n            except Exception:\n                continue\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PST forensic analysis report.\"\"\"\n        root = self.pst.get_root_folder()\n        self.process_folder(root)\n\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pst_file\": self.pst_path,\n            \"pst_size_bytes\": os.path.getsize(self.pst_path),\n            \"statistics\": dict(self.stats),\n            \"messages\": self.messages[:500],\n            \"attachments\": self.attachments[:200],\n        }\n\n        report_path = os.path.join(self.output_dir, \"pst_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2, default=str)\n\n        print(f\"[*] Total messages: {self.stats['total_messages']}\")\n        print(f\"[*] Total attachments: {self.stats['total_attachments']}\")\n        print(f\"[*] Parse errors: {self.stats['parse_errors']}\")\n        return report_path\n\n    def close(self):\n        self.pst.close()\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpst_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PSTForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n    analyzer.close()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Email Header Analysis\n\nKey headers for forensic investigation:\n\n| Header | Forensic Value |\n|--------|---------------|\n| Received | Message routing chain (read bottom to top) |\n| X-Originating-IP | Sender's actual IP address |\n| Message-ID | Unique identifier for correlation |\n| Date | Send timestamp |\n| Return-Path | Bounce address (may differ from From) |\n| DKIM-Signature | Domain authentication signature |\n| Authentication-Results | SPF, DKIM, DMARC verification results |\n| X-Mailer | Email client used |\n\n## References\n\n- MailXaminer PST Forensics: https:\u002F\u002Fwww.mailxaminer.com\u002Fblog\u002Foutlook-pst-file-forensics\u002F\n- libpff Documentation: https:\u002F\u002Fgithub.com\u002Flibyal\u002Flibpff\n- PST File Format Specification: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Foffice_file_formats\u002Fms-pst\u002F\n- SANS Email Forensics: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Femail-forensics\u002F\n\n## Example Output\n\n```text\n$ pffexport \u002Fevidence\u002Fjsmith_archive.pst -t \u002Fanalysis\u002Fpst_output\n\npffexport 20231205 - libpff PST\u002FOST Export Tool\n=================================================\nInput: \u002Fevidence\u002Fjsmith_archive.pst (2.3 GB)\n\nExporting PST contents...\n  Folders:       45\n  Messages:      12,456\n  Attachments:   3,234\n  Contacts:      567\n  Calendar:      234\n  Tasks:         89\n\nExport completed in 3m 42s.\n\n$ python3 pst_analyzer.py \u002Fanalysis\u002Fpst_output \u002Fanalysis\u002Femail_report\n\nPST Forensic Analysis Report\n==============================\nSource: jsmith_archive.pst (john.smith@corporate.com)\nDate Range: 2023-06-01 to 2024-01-18\n\n--- Mailbox Statistics ---\n  Total Emails:       12,456\n  Sent:               4,567\n  Received:           7,889\n  With Attachments:   3,234\n  Deleted (recovered): 234\n\n--- Phishing \u002F Suspicious Emails ---\nEmail #8923\n  Date:        2024-01-15 14:30:22 UTC\n  From:        \"IT Support\" \u003Cit-support@c0rporate-help.com>\n  To:          john.smith@corporate.com\n  Subject:     Urgent: Password Reset Required\n  Headers:\n    Return-Path:    bounce@mail-relay.c0rporate-help.com\n    X-Originating-IP: 203.0.113.55\n    Received:       from mail-relay.c0rporate-help.com (203.0.113.55)\n    SPF:            FAIL (domain c0rporate-help.com)\n    DKIM:           NONE\n    DMARC:          FAIL\n  Attachments:\n    - Password_Reset_Form.xlsm (245 KB) SHA-256: 7a3b8c9d...e1f2a3b4\n  Body Preview:  \"Dear Employee, Your password will expire in 24 hours.\n                  Please open the attached form to reset your credentials...\"\n\n--- Data Exfiltration Indicators ---\nEmail #9102\n  Date:        2024-01-16 03:15:45 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     (no subject)\n  Attachments:\n    - archive_part1.7z (24.5 MB) - encrypted\n    - archive_part2.7z (24.5 MB) - encrypted\n\nEmail #9103\n  Date:        2024-01-16 03:18:22 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     Re:\n  Attachments:\n    - archive_part3.7z (18.2 MB) - encrypted\n\n--- Keyword Hits ---\n  \"confidential\":     45 emails\n  \"password\":         23 emails\n  \"transfer\":         12 emails\n  \"resign\":           3 emails\n  \"delete evidence\":  1 email (Email #9200, 2024-01-17 22:30:00 UTC)\n\nSummary:\n  Phishing emails detected:    1 (initial compromise vector)\n  Suspicious sent emails:      5 (to personal accounts with attachments)\n  Encrypted attachments:       3 (67.2 MB total - possible exfiltration)\n  Report: \u002Fanalysis\u002Femail_report\u002Fpst_forensic_report.json\n```\n","# Analyzing Outlook PST for Email Forensics\n\n## Overview\n\nMicrosoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files are critical evidence sources in digital forensics investigations. PST files store email messages, calendar events, contacts, tasks, and notes in a proprietary binary format based on the MAPI (Messaging Application Programming Interface) property system. Forensic analysis of these files enables recovery of deleted emails (from the Recoverable Items folder), extraction of email headers for tracing message routes, analysis of attachments for malware or exfiltrated data, and reconstruction of communication patterns. Modern PST files use Unicode format with 4KB pages and can grow up to 50GB, while legacy ANSI format is limited to 2GB.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing outlook pst for email forensics\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- libpff\u002Fpffexport (open-source PST parser)\n- Python 3.8+ with pypff or libratom libraries\n- MailXaminer, Forensic Email Collector, or SysTools PST Forensics (commercial)\n- Microsoft Outlook (optional, for native PST access)\n- Sufficient disk space for extracted content\n\n## PST File Locations\n\n| Source | Path |\n|--------|------|\n| Outlook 2016+ Default | %USERPROFILE%\\Documents\\Outlook Files\\*.pst |\n| Outlook Legacy | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.pst |\n| OST Cache | %LOCALAPPDATA%\\Microsoft\\Outlook\\*.ost |\n| Archive | %USERPROFILE%\\Documents\\Outlook Files\\archive.pst |\n\n## Analysis with Open-Source Tools\n\n### libpff \u002F pffexport\n\n```bash\n# Export all items from PST file\npffexport -m all evidence.pst -t exported_pst\n\n# Export only email messages\npffexport -m items evidence.pst -t exported_emails\n\n# Export recovered\u002Fdeleted items\npffexport -m recovered evidence.pst -t recovered_items\n\n# Get PST file information\npffinfo evidence.pst\n```\n\n### Python PST Analysis\n\n```python\nimport pypff\nimport os\nimport json\nimport hashlib\nimport email\nimport sys\nfrom datetime import datetime\nfrom collections import defaultdict\n\n\nclass PSTForensicAnalyzer:\n    \"\"\"Forensic analysis of Outlook PST\u002FOST files.\"\"\"\n\n    def __init__(self, pst_path: str, output_dir: str):\n        self.pst_path = pst_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.pst = pypff.file()\n        self.pst.open(pst_path)\n        self.messages = []\n        self.attachments = []\n        self.stats = defaultdict(int)\n\n    def process_folder(self, folder, folder_path: str = \"\"):\n        \"\"\"Recursively process PST folders and extract messages.\"\"\"\n        folder_name = folder.name or \"Root\"\n        current_path = f\"{folder_path}\u002F{folder_name}\" if folder_path else folder_name\n\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                msg_data = self.extract_message(message, current_path)\n                if msg_data:\n                    self.messages.append(msg_data)\n                    self.stats[\"total_messages\"] += 1\n            except Exception as e:\n                self.stats[\"parse_errors\"] += 1\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                subfolder = folder.get_sub_folder(i)\n                self.process_folder(subfolder, current_path)\n            except Exception:\n                continue\n\n    def extract_message(self, message, folder_path: str) -> dict:\n        \"\"\"Extract forensic metadata from a single email message.\"\"\"\n        msg_data = {\n            \"folder\": folder_path,\n            \"subject\": message.subject or \"\",\n            \"sender\": message.sender_name or \"\",\n            \"sender_email\": \"\",\n            \"creation_time\": str(message.creation_time) if message.creation_time else None,\n            \"delivery_time\": str(message.delivery_time) if message.delivery_time else None,\n            \"modification_time\": str(message.modification_time) if message.modification_time else None,\n            \"has_attachments\": message.number_of_attachments > 0,\n            \"attachment_count\": message.number_of_attachments,\n            \"body_size\": len(message.plain_text_body or b\"\"),\n            \"html_size\": len(message.html_body or b\"\"),\n        }\n\n        # Extract transport headers for routing analysis\n        headers = message.transport_headers\n        if headers:\n            msg_data[\"headers_present\"] = True\n            msg_data[\"headers_size\"] = len(headers)\n            # Parse key headers\n            parsed = email.message_from_string(headers)\n            msg_data[\"from_header\"] = parsed.get(\"From\", \"\")\n            msg_data[\"to_header\"] = parsed.get(\"To\", \"\")\n            msg_data[\"date_header\"] = parsed.get(\"Date\", \"\")\n            msg_data[\"message_id\"] = parsed.get(\"Message-ID\", \"\")\n            msg_data[\"x_originating_ip\"] = parsed.get(\"X-Originating-IP\", \"\")\n            msg_data[\"received_headers\"] = parsed.get_all(\"Received\", [])\n\n        # Process attachments\n        for j in range(message.number_of_attachments):\n            try:\n                attachment = message.get_attachment(j)\n                att_data = {\n                    \"message_subject\": msg_data[\"subject\"],\n                    \"name\": attachment.name or f\"attachment_{j}\",\n                    \"size\": attachment.size,\n                    \"content_type\": \"\",\n                }\n                self.attachments.append(att_data)\n                self.stats[\"total_attachments\"] += 1\n            except Exception:\n                continue\n\n        return msg_data\n\n    def save_attachments(self, max_size_mb: int = 100):\n        \"\"\"Export attachments to disk for analysis.\"\"\"\n        att_dir = os.path.join(self.output_dir, \"attachments\")\n        os.makedirs(att_dir, exist_ok=True)\n\n        root = self.pst.get_root_folder()\n        self._save_attachments_recursive(root, att_dir, max_size_mb)\n\n    def _save_attachments_recursive(self, folder, att_dir, max_size_mb):\n        for i in range(folder.number_of_sub_messages):\n            try:\n                message = folder.get_sub_message(i)\n                for j in range(message.number_of_attachments):\n                    att = message.get_attachment(j)\n                    if att.size and att.size \u003C max_size_mb * 1024 * 1024:\n                        name = att.name or f\"unknown_{i}_{j}\"\n                        safe_name = \"\".join(c if c.isalnum() or c in \".-_\" else \"_\" for c in name)\n                        path = os.path.join(att_dir, safe_name)\n                        try:\n                            data = att.read_buffer(att.size)\n                            with open(path, \"wb\") as f:\n                                f.write(data)\n                        except Exception:\n                            continue\n            except Exception:\n                continue\n\n        for i in range(folder.number_of_sub_folders):\n            try:\n                self._save_attachments_recursive(folder.get_sub_folder(i), att_dir, max_size_mb)\n            except Exception:\n                continue\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PST forensic analysis report.\"\"\"\n        root = self.pst.get_root_folder()\n        self.process_folder(root)\n\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pst_file\": self.pst_path,\n            \"pst_size_bytes\": os.path.getsize(self.pst_path),\n            \"statistics\": dict(self.stats),\n            \"messages\": self.messages[:500],\n            \"attachments\": self.attachments[:200],\n        }\n\n        report_path = os.path.join(self.output_dir, \"pst_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2, default=str)\n\n        print(f\"[*] Total messages: {self.stats['total_messages']}\")\n        print(f\"[*] Total attachments: {self.stats['total_attachments']}\")\n        print(f\"[*] Parse errors: {self.stats['parse_errors']}\")\n        return report_path\n\n    def close(self):\n        self.pst.close()\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpst_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PSTForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n    analyzer.close()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Email Header Analysis\n\nKey headers for forensic investigation:\n\n| Header | Forensic Value |\n|--------|---------------|\n| Received | Message routing chain (read bottom to top) |\n| X-Originating-IP | Sender's actual IP address |\n| Message-ID | Unique identifier for correlation |\n| Date | Send timestamp |\n| Return-Path | Bounce address (may differ from From) |\n| DKIM-Signature | Domain authentication signature |\n| Authentication-Results | SPF, DKIM, DMARC verification results |\n| X-Mailer | Email client used |\n\n## References\n\n- MailXaminer PST Forensics: https:\u002F\u002Fwww.mailxaminer.com\u002Fblog\u002Foutlook-pst-file-forensics\u002F\n- libpff Documentation: https:\u002F\u002Fgithub.com\u002Flibyal\u002Flibpff\n- PST File Format Specification: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Foffice_file_formats\u002Fms-pst\u002F\n- SANS Email Forensics: https:\u002F\u002Fwww.sans.org\u002Fblog\u002Femail-forensics\u002F\n\n## Example Output\n\n```text\n$ pffexport \u002Fevidence\u002Fjsmith_archive.pst -t \u002Fanalysis\u002Fpst_output\n\npffexport 20231205 - libpff PST\u002FOST Export Tool\n=================================================\nInput: \u002Fevidence\u002Fjsmith_archive.pst (2.3 GB)\n\nExporting PST contents...\n  Folders:       45\n  Messages:      12,456\n  Attachments:   3,234\n  Contacts:      567\n  Calendar:      234\n  Tasks:         89\n\nExport completed in 3m 42s.\n\n$ python3 pst_analyzer.py \u002Fanalysis\u002Fpst_output \u002Fanalysis\u002Femail_report\n\nPST Forensic Analysis Report\n==============================\nSource: jsmith_archive.pst (john.smith@corporate.com)\nDate Range: 2023-06-01 to 2024-01-18\n\n--- Mailbox Statistics ---\n  Total Emails:       12,456\n  Sent:               4,567\n  Received:           7,889\n  With Attachments:   3,234\n  Deleted (recovered): 234\n\n--- Phishing \u002F Suspicious Emails ---\nEmail #8923\n  Date:        2024-01-15 14:30:22 UTC\n  From:        \"IT Support\" \u003Cit-support@c0rporate-help.com>\n  To:          john.smith@corporate.com\n  Subject:     Urgent: Password Reset Required\n  Headers:\n    Return-Path:    bounce@mail-relay.c0rporate-help.com\n    X-Originating-IP: 203.0.113.55\n    Received:       from mail-relay.c0rporate-help.com (203.0.113.55)\n    SPF:            FAIL (domain c0rporate-help.com)\n    DKIM:           NONE\n    DMARC:          FAIL\n  Attachments:\n    - Password_Reset_Form.xlsm (245 KB) SHA-256: 7a3b8c9d...e1f2a3b4\n  Body Preview:  \"Dear Employee, Your password will expire in 24 hours.\n                  Please open the attached form to reset your credentials...\"\n\n--- Data Exfiltration Indicators ---\nEmail #9102\n  Date:        2024-01-16 03:15:45 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     (no subject)\n  Attachments:\n    - archive_part1.7z (24.5 MB) - encrypted\n    - archive_part2.7z (24.5 MB) - encrypted\n\nEmail #9103\n  Date:        2024-01-16 03:18:22 UTC\n  From:        john.smith@corporate.com\n  To:          j.smith.personal8842@protonmail.com\n  Subject:     Re:\n  Attachments:\n    - archive_part3.7z (18.2 MB) - encrypted\n\n--- Keyword Hits ---\n  \"confidential\":     45 emails\n  \"password\":         23 emails\n  \"transfer\":         12 emails\n  \"resign\":           3 emails\n  \"delete evidence\":  1 email (Email #9200, 2024-01-17 22:30:00 UTC)\n\nSummary:\n  Phishing emails detected:    1 (initial compromise vector)\n  Suspicious sent emails:      5 (to personal accounts with attachments)\n  Encrypted attachments:       3 (67.2 MB total - possible exfiltration)\n  Report: \u002Fanalysis\u002Femail_report\u002Fpst_forensic_report.json\n```\n",{"name":5,"tags":49,"capec":59,"model":28,"tools":60,"domain":40,"maxTurns":64,"nist_csf":65,"subdomain":31,"description":7,"nist_ai_rmf":70},[50,51,52,24,53,54,55,56,57,58],"email-forensics","pst","ost","mapi","email-headers","attachments","deleted-emails","libpff","eml-extraction",[],[61,38,62,63],"Read","Glob","Grep",20,[66,67,68,69],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01",[71,72,73],"MANAGE-2.4","MANAGE-3.1","MEASURE-3.1","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail\u002Fforensics\u002Foutlook\u002Fforensic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-outlook-forensic",{"tool":87,"command":88},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-outlook-forensic",{"tool":90,"command":91},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-outlook-forensic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fforensics\u002Foutlook\u002Fforensic\u002FSKILL.md",true,[95],{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"index.json","REFERENCE","参考文档",689,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fforensics\u002Foutlook\u002Fforensic\u002Findex.json",[102,125,145,164,186,202],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[109,110,111,112,113,34,114,115,116,117,118,119,120,121,122,123,25,40,124],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[132,109,133,112,134,135,136,40,38,37,137,138,139,140,34,141,142,33,143,144],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[152,153,154,155,156,157,40,38,158,37,36,159,34,33,160,161,31,162,163,28],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","windows-registry","regripper",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[110,171,172,173,174,175,176,114,177,40,124,178,179,180,181,182,183,184,185,34],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[193,194,110,195,173,175,196,114,197,177,40,124,37,198,199,200,201,185,34,115],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[209,110,173,210,196,114,211,212,40,124,213,214,215,216,217,218,34,115,219,32],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched"]