Email parser module

Autopsy Help
1

I’ll cut to the chase. I was given a flash drive with a single PST file and I imaged it to an E01. Upon running it through the email module, the only results that it gave me were from the Deleted folder; ~15k messages.

I have since began opening the PST using Stellar PST Viewer, and it has already returned more than 200,000 results.

Does anyone know why it only returned results from this directory? One thing that I noticed was that the Deleted folder is at the top of the root directory, but so are others.

Any thoughts? Thanks in advance!

1 Like
2

I think Autopsy uses java-libpst-0.9.3/4 library and it is very broken, at least with OST files, see https://github.com/rjohnsondev/java-libpst/issues/60

You should be more lucky using pffexport from libpff library, maybe that was used by autopsy to recover the deleted emails. You also could try iped forensic tool, it uses pffexport when java-libpst fails.

1 Like
3

Thanks for the response! I’ll def take a look!