# Find particular email message & extract when a keyword hits a PST/OST file data

**URL:** <https://sleuthkit.discourse.group/t/find-particular-email-message-extract-when-a-keyword-hits-a-pst-ost-file-data/266>\
**Category:** Autopsy Help\
**Created:** [September 16, 2019, 1:45pm UTC](https://sleuthkit.discourse.group/t/find-particular-email-message-extract-when-a-keyword-hits-a-pst-ost-file-data/266 "2019-09-16T13:45:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![klllmmm](https://avatars.discourse-cdn.com/v4/letter/k/e95f7d/32.png) [@klllmmm](https://sleuthkit.discourse.group/u/klllmmm)\
**Post date:** [September 16, 2019, 1:45pm UTC](https://sleuthkit.discourse.group/t/find-particular-email-message-extract-when-a-keyword-hits-a-pst-ost-file-data/266/1 "2019-09-16T13:45:17Z")

</div>

1. Is there a way to identify relevant email (msg file) when a keyword hits data in an email PST or OST file. I just want to extract a particular msg file with the keyword hit.

Ex.

![2_pics](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/a00672cb327cf9b0b112cd5f16767eda8e265917.jpeg)

1. If the same PST/OST hits two keywords and tagged in two different tags (one separate tag for each keyword), will this appear correctly in the reports? Do I have to delete the incorrect tag that automatically comes from the previous keyword tagged with the OST/PST file?

Thanks for your thoughts.

---

<div class="post-metadata">

**Author:** ![mfrade](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mfrade](https://sleuthkit.discourse.group/u/mfrade)\
**Post date:** [September 23, 2019, 12:20pm UTC](https://sleuthkit.discourse.group/t/find-particular-email-message-extract-when-a-keyword-hits-a-pst-ost-file-data/266/2 "2019-09-23T12:20:45Z")

</div>

You can try the EmailSlicer plugin: [https://github.com/labcif/EmailSlicer](https://github.com/labcif/EmailSlicer)  
For now it only supports PST files and exports to EML (the same format used by Thunderbird)