Error while processing ost file

Autopsy Help
1

Running initial analysis of drive image. received message error while processing emailaddress.ost file. according to the provided inventory the user was running office Standard version 2019. Is there a known issue with office/outlook 2019 and Autopsy? Any recommendations for analyzing the ost files?

2

Can you supply the log file from the case to see if there are any messages to help debug the problem.

Kind regards.

Mark

3

WARNING: CDThorne@wyomingcat.com.ost-162792: Failed to create internal java-libpst PST file to parse:

Unable to find node: 97

com.pff.PSTException: Unable to find node: 97

com.pff.PSTFile.findBtreeItem(PSTFile.java:734)

com.pff.PSTFile.getDescriptorIndexNode(PSTFile.java:748)

com.pff.PSTFile.processNameToIdMap(PSTFile.java:200)

com.pff.PSTFile.(PSTFile.java:167)

org.sleuthkit.autopsy.thunderbirdparser.PstParser.open(PstParser.java:101)

org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.processPst(ThunderbirdMboxFileIngestModule.java:189)

org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.process(ThunderbirdMboxFileIngestModule.java:141)

org.sleuthkit.autopsy.ingest.FileIngestPipeline$PipelineModule.process(FileIngestPipeline.java:230)

org.sleuthkit.autopsy.ingest.FileIngestPipeline.process(FileIngestPipeline.java:129)

org.sleuthkit.autopsy.ingest.DataSourceIngestJob.process(DataSourceIngestJob.java:806)

org.sleuthkit.autopsy.ingest.FileIngestTask.execute(FileIngestTask.java:44)

org.sleuthkit.autopsy.ingest.IngestManager$ExecuteIngestJobTasksTask.run(IngestManager.java:926)

java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

java.util.concurrent.FutureTask.run(FutureTask.java:266)

java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

java.lang.Thread.run(Thread.java:748)

2019-11-08 12:26:48.81 org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule processPst

INFO: PSTParser failed to parse CDThorne@wyomingcat.com.ost

2019-11-08 12:26:48.81 org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule processPst

INFO: Failed to delete temp file: CDThorne@wyomingcat.com.ost-162792

4

Does anyone have some update on this?

I am having a similar issue, while trying to parse an OST file I receive the messages “Error while processing xxxxx.ost” and “Only files from Outlook 2003 and later are supported”, although it is a recent OST file.

I can’t seem to find any other logs. In the case folder, “autopsy.log.0” is empty.