How to: Export the content of an OST file for forensics

[DustinB3403]

So you get a call from a customer, that customer ask you to find some email, you search and find a ton of PST files and several OST (Outlook Data File).

Opening the PST files is quite easy assuming you have Outlook. The OST files are generally way more difficult to open, because they aren't meant to be "opened".

There are of course tools that will do this for you, but why spend money when you can do it for free with open source software.

On WSL I've got Ubuntu 2010, from here you'll want to run sudo apt install pff-tools

Once that is installed, you can use pff-tools to export the content into a new folder in the same directory as the OST.

So pffexport -f all -m all /ost/path/client.ost

That's it, all that is required to open an OST file and extract the content.